Human Feedback 기반 False Alarm 감소 및 분석 부담 완화 방안 연구

초록

Recent network attacks have increased the complexity of intrusion detection environments due to automated large-scale scanning and encrypted communications, resulting in excessive alerts and high false alarm rates in security operation centers(SOCs). This makes it difficult to improve operational efficiency through detection performance alone. To address this issue, this paper proposes FEED-NIDS(Feedback-Driven Extensible Network Intrusion Detection System). The framework combines detection confidence with time-based behavioral analysis to selectively process low-reliability alerts and constructs structured Evidence Packs to store analyst feedback systematically. Using similarity-based retrieval, past feedback is reused for new alerts. Experimental results show that repeated false alarms decrease after feedback application and that accumulated feedback improves decision consistency and alert handling efficiency. This study suggests that the proposed framework can enhance operational efficiency through confidence-based selection, feedback reuse, and selective interpretation.

키워드