Loading [a11y]/accessibility-menu.js
Data Auditing for Intelligent Network Security Monitoring | IEEE Journals & Magazine | IEEE Xplore

Data Auditing for Intelligent Network Security Monitoring


Abstract:

Data auditing is a process to consistently keep the quality of data high, but this process is generally missing in network security monitoring. When network-based intrusi...Show More

Abstract:

Data auditing is a process to consistently keep the quality of data high, but this process is generally missing in network security monitoring. When network-based intrusion detection systems catch any suspicious packet, they generate alert messages that are further investigated by security analysts. An alert is generally assigned to only one analyst at best, and then the analyst determines whether the alert is true or false, called labeling. Therefore, different analysts may label very similar alerts with different labels. In this article, we introduce this problem of inconsistent labeling in network security monitoring and present a new automatic data auditing method to check if any human mistake has occurred for the labeling. Through our experiments on two data sets, a private one from a real security operations center and an open data set for reproducible experiments, we confirm that the new auditing method can catch incorrect labels, and the accuracy of a machine learning model on the data set can be enhanced through the label correction.
Published in: IEEE Communications Magazine ( Volume: 61, Issue: 3, March 2023)
Page(s): 74 - 79
Date of Publication: 12 December 2022

ISSN Information:

Funding Agency:


Contact IEEE to Subscribe

References

References is not available for this document.