A framework on predicting network based IDS alerts

To keep up with the increasing prevalence of cybersecurity attacks, improvements in the current prevention and detection strategies must be made. One of the key areas of interest in improving attack prevention is the application of machine learning techniques to existing alerts being captured by intrusion detection systems (IDS) in order to predict different aspects of future attacks. Much focus has been given by researches to predict the next alert or alert type, however, this information is not enough for making intrusion responses. There have been few researches that tried to enhance the prediction context by including the attacker and victim nodes. This research presents a framework of generating prediction models on intrusion alerts with the inclusion of time in the prediction context