查看文章

Virtually every enterprise network has deployed intrusion detection systems (NIDSes) for security threats detection, prevention, and response. To defend against cyberattacks with increasing diversity and intensity, there is a pressing need to implement artificial intelligence (AI)-powered NIDS system which can unify the strength of existing solutions. In this paper, we explore the feasibility of leveraging existing security solutions to generate labeled datasets that can facilitate the development of such an advanced AI-powered NIDS. Assigning proper labels to communication sessions that are detected as suspicious by NIDSes are carried out in the following steps. First, from the captured packet file, we locate the communication sessions that trigger the detection rules of deployed NIDSes. Second, for each located communication session, we investigate the causal factors in the session packets and assign a unified alert …