Forecasting for Return on Security Information Investment: New Approach on Trends in Intrusion Detection and Unwanted Internet Traffic

作者：Elvis Pontes, Adilson Eduardo Guelfi, Edson E. Alonso · 发表于：IEEE Latin America Transactions · 年份：2009 · DOI：10.1109/tla.2009.5349043 · 被引用次数：10 · 研究领域：Network Security and Intrusion Detection、Information and Cyber Security、Complex Network Analysis Techniques

The methods used to determine the Return on Security Investment (ROSI) concern historic incidents' analysis, cost avoidance resulting from resistance, recognition and reconstitution efforts. Although some ROSI methods consider security incidents' likelihood, they don't approach studies about forecasts and trends of incidents or unwanted events. Likewise other sciences (seismology, meteorology, vulcanology, and economics) in which extent efforts are done for forecasts, information technology and information security may analyze tendencies, as Internet traffic and intrusion detection trends. The aim of this paper is to show a forecasting approach which could be aggregated to common ROSI methods. In this study, forecasting approach is based on two trend techniques: moving averages and Fibonacci sequence ‑ for security incidents with intrusion detection system (IDS) and unwanted Internet traffic. Tests applied over two datasets (DARPA, KDD), with an IDS, showed that the employed techniques define incidents trends; therefore, forecasting approach may be complementary to ROSI methods