An Approach to Meta-Alert Generation to Reduce Analyst Workload

Abstract

This is the era of Technology. Digitization becomes a trend today. Organizations are trying to become more digitized than one another because of the growth in a number of internet users. The Internet is a popular place among criminals too. They perform criminal activities for their benefit over the internet. These actions are called cybercrimes. The reason for increased cybercrime is the enhanced use of the internet. These days millions of attacks are being performed each year. The prodigious number of attacks makes the data under potential infringement. So as far as concerned, cybersecurity becomes the most important issue these days. In recent years intrusions are increasing rapidly that result in compromise with the protection of user data. Intrusion detection systems are used to detects and prevents these intrusions. Port Scanning is a common type of intrusions. Generally, it takes place as the first step of an intrusion. Port-scanner is software intended to probe a machine for open ports. Port scanning attacks result in huge amount of network alerts which is manually analyzed by the network administrator. In the proposed work, a novel approach is presented to minimize this huge amount of the similar alerts of stealth port scanning attack by generating meta-alert. To validate the performance of the proposed method an experiment has been carried out using MACCDC dataset. And it is observed that 99.65% alerts are significantly reduced.