Cyber Informedness: A New Metric using CVSS to Increase Trust in Intrusion Detection Systems

Robin Duraz (1, 2, 3, 4, 5) , David Espes (5, 6, 7) , Julien Francq (8) , Sandrine Vaton (1, 2, 4, 5)

1 IMT Atlantique - INFO - Département Informatique
2 Lab-STICC_MATHNET - Equipe Math & Net
3 Chaire de Cyber Défense des Systèmes Navals [Brest]
4 IMT Atlantique - IMT Atlantique
5 Lab-STICC - Laboratoire des sciences et techniques de l'information, de la communication et de la connaissance
6 Lab-STICC_IRIS - Equipe SecurIty and Resilience of Information Systems
7 UBO - Université de Brest
8 Naval Group

Intrusion Detection Systems (IDSs) are essential cybersecurity components. Previous cyberattack detection methods relied more on signatures and rules to detect cyberattacks, although there has been a change in paradigm in the last decade, with Machine Learning (ML) enabling more efficient and flexible statistical methods. However, ML is currently unable to integrate cybersecurity information into its inner workings. This paper introduces Cyber Informedness, a new metric taking into account cybersecurity information to give a more informed representation of performance, influenced by the severity of the attacks encountered. This metric uses a de facto standard in cybersecurity: the Common Vulnerability Scoring System (CVSS). Results on two public datasets show that this new metric validates results obtained with generic metrics. Furthermore, this new metric highlights ML-based IDSs that prioritize high performance on severe attacks, which is not visible with generic metrics. Consequently, this new metric nicely completes generic metrics by bridging the gap between ML and cybersecurity.

Domaines: Cryptographie et sécurité [cs.CR]

Robin Duraz, David Espes, Julien Francq, Sandrine Vaton. Cyber Informedness: A New Metric using CVSS to Increase Trust in Intrusion Detection Systems. EICC 2023: European Interdisciplinary Cybersecurity Conference, Jun 2023, Stavanger, Norway. ⟨10.1145/3590777.3590786⟩. ⟨hal-04159578⟩