APHRODITE: an Anomaly-based Architecture for False Positive Reduction
Damiano Bolzoni, Sandro Etalle
Abstract
We present APHRODITE, an architecture designed to reduce false positives in network intrusion detection systems. APHRODITE works by detecting anomalies in the output traffic, and by correlating them with the alerts raised by the NIDS working on the input traffic. Benchmarks show a substantial reduction of false positives and that APHRODITE is effective also after a "quick setup", i.e. in the realistic case in which it has not been "trained" and set up optimally
Create a lesson
Related papers
RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
Junjie Zhang, Hui Liu, Kecheng Chen et al.
Beyond F1: Evaluating Coverage and Failure Recovery in AI Model Security Scanners
Qianlong Lan, Vinothini Pandurangan, Anuj Kaul et al.
When Context Gets Root: Privilege Escalation in LLM Harnesses
Xingbang He, Yuanwei Chen, Yi Qian et al.
Low-ASR Backdoors: Exploiting Attack Success Rate Reduction and Attacker-Defender Asymmetry
Arham Riaz, Ting Yu
SPA: Securing Persistent LLM Agents Across Queries with Plan-First Information-Flow Control
Dylan Girrens, Guangjing Wang
From Security Events to Conflict States: A Three-layer Cyber Defense Scenario Model for Enhanced Cyber Situational Awareness
Miguel Requena Micó, Mario Fernandez-Tarraga, Daniel Díaz-López et al.