Hands-On Artificial Intelligence for Cybersecurity

False alarm management in anomaly detection

We have previously seen how anomaly detection gives rise to rather consistent estimation errors. In particular, in the case of IDS based on signatures, the risk of error is represented by the high number of false negatives, that is, attacks that are not detected.

It is the same type of risk that we incur when using antivirus software. When a correspondence with the suspicious signature is not found, the IDS does not detect any anomalies.

On the other hand, in the case of anomaly-driven IDS, which is programmed to detect anomalies automatically, we face the risk of having a high number of false positives; that is, anomalies that are detected despite not being harmful.

To adequately manage these false ...