APHRODITE: an Anomaly-based Architecture for False Positive Reduction

We present APHRODITE, an architecture designed to reduce false positives in network intrusion-detection systems. APHRODITE works by detecting anomalies in the outgoing traffic, and by correlating them with the alerts raised by the NIDS analyzing the incoming traffic. Benchmarks show a substantial reduction of false positives between 50% and 100%.

• Type: Journal
• Year: 2006
• Where: CORR
• Authors: Damiano Bolzoni, Sandro Etalle
• Keywords: APHRODITE, CORR 2006, Education, False Positives, Network Intrusion-detection Systems