IDS Systems Through Proactive Vulnerability Scanning in Network Environments

The aim of this article was to increase the effectiveness of intrusion detection systems (IDS) by reducing the number of false positive alerts. We designed and implemented a solution that combines proactive vulnerability scanning with a correlation mechanism for alert processing. The solution is based on the integration of Snort and Nessus tools, with network traffic data collected and filtered using Wireshark. The correlation algorithm is implemented in the Python programming language. For testing purposes, we used our own data and the publicly available DARPA 2000 LLDOS 1.0 dataset. The results of the experiments confirm the reduction in false positive alerts and demonstrate the effectiveness of the proposed solution.