Towards Alarm Reduction in Intrusion Detection: A Recurrent Neural Network Approach

Intrusion detection systems (IDSs) are one of the most commonly deployed systems to detect cyber attacks. One major problem of IDSs is the large amount of false alarms (or false positives) generated in a practical network. In recent decades, many researchers utilized machine learning techniques to help reduce false alarms, i.e., deep learning is quite popular in recent years. However, most research studies mainly consider one dataset in the evaluation, and it is unclear whether the approach can be scalable for other network settings. Motivated by such challenges, in this work, we introduce a hybrid deep learning-based false alarm filtration method, by combining a modern recurrent neural network (RNN) and a concise alert correlation method to reduce false positives for an IDS. To evaluate the performance, we consider three publicly available datasets such as DARPA, UNSW-NB and CSE-CIC-IDS. Experimental results demonstrate that our approach can reduce up to 99.35% false alarms in the best case.