Categorisation of False Positives: Not All Network Anomalies are Born Equal

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F14%3A00225814" target="_blank" >RIV/68407700:21230/14:00225814 - isvavai.cz</a>

Výsledek na webu

—

DOI - Digital Object Identifier

—

Jazyk výsledku

angličtina

Název v původním jazyce

Categorisation of False Positives: Not All Network Anomalies are Born Equal

Popis výsledku v původním jazyce

Anomaly detection algorithms used to identify the network attacks frequently produce misclassifications. Between the misclassifications, the false positives, i.e., false alarms that occur when the system misclassifies a legitimate behaviour as anomaly, are the most important ones. We will break down the false positives produced by the anomaly detection systems into categories. For each category, we will analyse its origin, impact on the user and impact on security properties of the system and possible mitigation techniques. We will also argue for further research in the areas where the impact on system usability is high, but the current techniques don?t allow us to make a reliable decision.

Název v anglickém jazyce

Categorisation of False Positives: Not All Network Anomalies are Born Equal

Popis výsledku anglicky

Anomaly detection algorithms used to identify the network attacks frequently produce misclassifications. Between the misclassifications, the false positives, i.e., false alarms that occur when the system misclassifies a legitimate behaviour as anomaly, are the most important ones. We will break down the false positives produced by the anomaly detection systems into categories. For each category, we will analyse its origin, impact on the user and impact on security properties of the system and possible mitigation techniques. We will also argue for further research in the areas where the impact on system usability is high, but the current techniques don?t allow us to make a reliable decision.

Druh

O - Ostatní výsledky

CEP obor

JC - Počítačový hardware a software

OECD FORD obor

—

Projekt

—

Návaznosti

I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Rok uplatnění

2014

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů