在NDR系统中有效降低噪音:一种简单而强大的先验方法
Sajad Homayoun1,2, Magnea Haraldsdóttir2, Emil Lynge2
1Cyber Security Group, CMI Section, Department of Electronic Systems, Aalborg University, 2450 Copenhagen, Denmark.
Sensors (Basel, Switzerland)
|October 26, 2024
概括
网络检测和响应 (NDR) 系统中频繁的安全警报可能是噪音. 这项研究使用了一种简单的基于Apriori的方法来识别和减少这些噪音警报,有效过超过40%.
科学领域:
- 网络安全 网络安全
- 数据科学数据科学数据科学
- 网络安全 网络安全
背景情况:
- 噪音警报是入侵检测系统的一个重大挑战,导致分析师过载和潜在的系统中断.
- 现实世界中的警报通常来自常规软件或用户活动,而不是实际的安全问题.
研究的目的:
- 提出和验证一种方法来减少网络检测和响应 (NDR) 系统中的噪声警报.
- 为了证明更简单的算法可以有效地解决噪音警报的挑战.
主要方法:
- 开发了一个基于Apriori的算法来识别符合特定频率标准的频繁,长期的安全警报.
- 该方法在来自丹麦NDR解决方案客户的现实数据上进行了测试.
- 通过比较在应用拟议解决方案之前和之后的噪声水平来评估性能.
主要成果:
- 基于Apriori的方法成功地减少了对真实客户的大多数警报类型的噪音警报.
- 超过40%的警报通过设定70%的最低发生值来过.
- 某些警报类别的噪音降低超过了90%.
结论:
- 符合定义标准的频繁安全警报可以有效地被归类为噪音.
- 更简单的算法解决方案,如基于Apriori的方法,对于减少NDR系统中的噪声是可行的和有效的.
- 拟议的方法为在实际的NDR环境中降低噪声提供了高性能解决方案.
相关概念视频
Downsampling
133
When considering a sampled sequence with zero values between sampling instants, one can replace it by taking every N-th value of the sequence. At these integer multiples of N, the original and sampled sequences coincide. This process, known as decimation, involves extracting every N-th sample from a sequence, thereby creating a more efficient sequence.
The Fourier transform of the decimated sequence reveals a combination of scaled and shifted versions of the original spectrum. This...
The Fourier transform of the decimated sequence reveals a combination of scaled and shifted versions of the original spectrum. This...
133
Upsampling
206
Managing signal sampling rates is essential in digital signal processing to maintain signal integrity. A decimated signal, characterized by a reduced frequency range due to its lower sampling rate, can be upsampled by inserting zeros between each sample. This upsampling process expands the original spectrum and introduces repeated spectral replicas at intervals dictated by the new Nyquist frequency. To refine this zero-inserted sequence, it is passed through a lowpass filter with a cutoff...
206
Double Resonance Techniques: Overview
191
Double resonance techniques in Nuclear Magnetic Resonance (NMR) spectroscopy involve the simultaneous application of two different frequencies or radiofrequency pulses to manipulate and observe two distinct nuclear spins. One important application of double resonance is spin decoupling, which selectively suppresses coupling with one type of nucleus while observing the NMR signal from another nucleus, simplifying the spectrum and enhancing resolution.
Spin decoupling is usually achieved by...
Spin decoupling is usually achieved by...
191
Insensitive Nuclei Enhanced by Polarization Transfer (INEPT)
267
Insensitive Nuclei Enhanced by Polarization Transfer (INEPT) is an advanced Nuclear Magnetic Resonance (NMR) technique specifically designed to detect and enhance the signals of low-abundance nuclei, such as carbon-13 and nitrogen-15, in small molecules. The fundamental principle behind INEPT is the transfer of polarization from a more abundant and highly polarizable nucleus, typically hydrogen-1, to the low-abundance nucleus of interest. This process effectively boosts the NMR signal of the...
267
¹³C NMR: ¹H–¹³C Decoupling
1.0K
The probability of having two carbon-13 atoms next to each other is negligible because of the low natural abundance of carbon-13. Consequently, peak splitting due to carbon-carbon spin-spin coupling is not observed in spectra. However, protons up to three sigma bonds away split the carbon signal according to the n+1 rule, resulting in complicated spectra.
A broadband decoupling technique is used to simplify these complex, sometimes overlapping, signals. Broadband decoupling relies on a...
A broadband decoupling technique is used to simplify these complex, sometimes overlapping, signals. Broadband decoupling relies on a...
1.0K
Mechanistic Models: Compartment Models in Algorithms for Numerical Problem Solving
42
Mechanistic models play a crucial role in algorithms for numerical problem-solving, particularly in nonlinear mixed effects modeling (NMEM). These models aim to minimize specific objective functions by evaluating various parameter estimates, leading to the development of systematic algorithms. In some cases, linearization techniques approximate the model using linear equations.
In individual population analyses, different algorithms are employed, such as Cauchy's method, which uses a...
In individual population analyses, different algorithms are employed, such as Cauchy's method, which uses a...
42


