IDS operation management method using Holt-Winters method

IDS(Intrusion Detection System) is widely used. However, IDS has a problem that it is difficult to manage its operation because of occurring a large number of alerts. As a general usage of IDS, it is known that a certain threshold value is set and only the alerts exceeding it are reported. Generally, the threshold values are determined based on the subjectivity of administrator. Therefore, we have proposed a novel IDS operation management method which does not rely on the subjectivity of the administrator by using predicted number of IDS alerts by Holt-Winters method. However, there has been a problem that the prediction accuracy deteriorated when large detection of an unexpected alert existed at the learning time of Holt-Winters method. In this paper, we propose a new method to calculate forecast values sequentially, excluding large detection of alerts and evaluate its prediction accuracy. Lastly we discuss the operation management method of IDS.