BARS: Benign-Anchored Ranking and Selection for False Alarm Reduction in Network Intrusion Detection

False alarms remain a major barrier to deploying network intrusion detection systems NIDS. In high-volume environments, even a sub-1% false positive rate can generate tens of thousands of daily alerts. Filter-based feature selection is attractive because it operates upstream of the classifier and...