APHRODITE: an Anomaly-based Architecture for False Positive Reduction
Damiano Bolzoni, Sandro Etalle
Abstract
We present APHRODITE, an architecture designed to reduce false positives in network intrusion detection systems. APHRODITE works by detecting anomalies in the output traffic, and by correlating them with the alerts raised by the NIDS working on the input traffic. Benchmarks show a substantial reduction of false positives and that APHRODITE is effective also after a "quick setup", i.e. in the realistic case in which it has not been "trained" and set up optimally
Create a lesson
Related papers
Bilateral Protection for Private LoRA Inference with Intel TDX
Xiaodong Li, Mingyuan Ma, Dongbo Yan
Can Benign Skills Induce Misaligned Behavior in LLM Agents?
Xuanye Zhang, Yongsen Zheng, Kaiyu Zhou et al.
The Native Menace: Host-to-Browser Cross-Boundary Attacks via Native Messaging
Jyotirmay Chauhan, Rownak Islam, Jason Polakis
When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation
Qinghua Mao, Xi Lin, Yuxin Qi et al.
VerfGraph: Efficient Zero-Knowledge Verifiable Graph Query Evaluation System
Tianyi Ma, Yuncong Zhang, Yuanzhuo Yu et al.
ScrambleMark: Zero-Query Watermark-Agnostic Black-Box Evasion of Modern Speech Watermarking
Binhao Ma, Weikang Ding, Hanqing Guo et al.