Merging Guaranteed Possibilistic Bases to Rank IDS Alerts

  • Lydia Bouzar-Benlabiod
  • Lila Meziani
  • Nacer-Eddine Rim
  • Zakaria Mellal
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10868)

Abstract

Intrusion Detection Systems (IDS) are security tools that generate alerts when detecting a malicious activity. The main drawback of IDS is the high number of generated alerts. We propose an approach that integrates the preferences of several security experts to rank IDS results. The experts’ preferences are expressed either in IFO-BCF (Instantiated First Order) logic or in IFO-guaranteed possibilistic one. A new logical preferences merging algorithm is given, it takes in input the different experts’ preferences and produces a unique preferences base. The resulted preferences base is used to rank the IDS alerts.

Keywords

IDS alerts Preferences merging Guaranteed possibilistic logic IFO formulas 

References

  1. 1.
    Benferhat, S., Dubois, D., Prade, H.: How to infer from inconsistent beliefs without revising ? In: Proceedings of the International Joint Conference on Artificial Intelligence, IJCAI 1995, pp. 1449–1455, Montreal Canada, August 1995Google Scholar
  2. 2.
    Benferhat, S., Kaci, S.: Logical representation and fusion of prioritized information based on guaranteed possibility measures: application to the distance-based merging of classical bases. Artif. Intell. 148(1), 291–333 (2003)MathSciNetCrossRefGoogle Scholar
  3. 3.
    Bouzar-Benlabiod, L., Benferhat, S., Bouabana-Tebibel, T.: Instantiated first order qualitative choice logic for an efficient handling of alerts correlation. Intell. Data Anal. 19(1), 3–27 (2015)Google Scholar
  4. 4.
    Brewka, G., Benferhat, S., Le Berre, D.: Qualitative choice logic. Artif. Intell. 157(1), 203–237 (2004)MathSciNetCrossRefGoogle Scholar
  5. 5.
    Dubois, D., Lang, J., Prade, H.: Possibilistic logic. In: Gabbay, D., Hogger, C., Robinson, J. (eds.) Handbook of Logic in Artificial Intelligence and Logic Programming, vol. 3. Oxford University Press, New York (1994)Google Scholar
  6. 6.
    Dubois, D., Prade, H.: Possibility theory as a basis for preference propagation in automated reasoning. In: IEEE International Conference on Fuzzy Systems, pp. 821–832 (1992)Google Scholar
  7. 7.
    Kraus, S., Lehmann, D., Magidor, M.: Nonmonotonic reasoning, preferential models and cumulative logics. Artif. Intell. 44(12), 167–207 (1990)MathSciNetCrossRefGoogle Scholar
  8. 8.
    Lang, J.: Possibilistic logic: complexity and algorithms. In: Kohlas, J., Moral, S. (eds.) Algorithms for Uncertainty and Defeasible Reasoning, volume 5 of Handbook of Defeasible Reasoning and Uncertainty Management Systems (Gabbay D., Smets P. Eds.), vol. 5, pp. 179–220. Kluwer Academic Publishers, Dordrecht (2001)CrossRefGoogle Scholar
  9. 9.
    Mu, K., Liu, W., Jin, Z., Bell, D.A.: A syntax-based approach to measuring the degree of inconsistency for belief bases. Int. J. Approx. Reason. 52(7), 978–999 (2011)MathSciNetCrossRefGoogle Scholar
  10. 10.
    Qi, G., Liu, W., Bell, D.A.: Measuring conflict and agreement between two prioritized knowledge bases in possibilistic logic. Fuzzy Sets Syst. 161(14), 1906–1925 (2010)MathSciNetCrossRefGoogle Scholar

Copyright information

© Springer International Publishing AG, part of Springer Nature 2018

Authors and Affiliations

  • Lydia Bouzar-Benlabiod
    • 1
  • Lila Meziani
    • 1
  • Nacer-Eddine Rim
    • 1
  • Zakaria Mellal
    • 1
  1. 1.Laboratoire de la Communication dans les Systèmes InformatiquesEcole nationale Supérieure d’InformatiqueOued-SmarAlgeria

Personalised recommendations