APHRODITE: an Anomaly-based Architecture for False Positive Reduction
密码学与安全
2007-05-23 v1
摘要
We present APHRODITE, an architecture designed to reduce false positives in network intrusion detection systems. APHRODITE works by detecting anomalies in the output traffic, and by correlating them with the alerts raised by the NIDS working on the input traffic. Benchmarks show a substantial reduction of false positives and that APHRODITE is effective also after a "quick setup", i.e. in the realistic case in which it has not been "trained" and set up optimally
引用
@article{arxiv.cs/0604026,
title = {APHRODITE: an Anomaly-based Architecture for False Positive Reduction},
author = {Damiano Bolzoni and Sandro Etalle},
journal= {arXiv preprint arXiv:cs/0604026},
year = {2007}
}