Evaluation of Deviating Alerts coming from Behavioral Intrusion Detection System

Abstract

The growth of behavioral intrusion detection solutions raises a new issue. The update of normal references is necessary and determines the flexibility and accuracy of the detection. This paper describes a decision block function used to update a behavioral intrusion detection method. Based on a risk analysis and support vector machines, our approach completes the behavioral anomaly detection using Bayesian modeling based on a global vision of the system approach.