Efficient Hybrid Network (Wired and Wireless) Intrusion Detection using Statistical Data Streams and Detection of Clustered Alerts

Thangavel Thangavel

doi:10.3844/jcssp.2011.1318.1324

Abstract

Problem statement: Wireless LAN IEEE 802.11 protocols are growing rapidly and security has always been a concern with the security of wired network. Wireless networks encountered threats from unauthorized access to network resources, installation of access points and illegal sniffing (refer as classical intrusion threats). In its current hybrid wired and wireless network attacks on the generally distinguish from normal cable intrusion attacks, selective forwarding attacks, MAC spoofing attacks. This means that the simple traditional misuse detection and anomaly detection model alone not sufficient to identify these mixed attacks on the hybrid network (wired and wireless). Approach: Our proposed work presents a hybrid cluster-based intrusion detection statistical anomaly, for detecting selective forwarding in wireless networks and intrusion into traditional wired networks. The detection was identified by changes in the statistical characteristics of data traffic on the wireless network. The clustering of data traffic based on the characteristics of alert classes and normal classes improve the performance of our hybrid intrusion detection in both wired and wireless network efficiently. The simulation was performed to evaluate the performance of wired intrusion detection systems to the proposed wireless intrusion detection on the data traffic in the area of wired and wireless hybrid network environment. Results: The proposed wireless intrusion detection system sharply detect the statistical change point detection of intrusion behavior in terms of attack rate and throughput of data traffic. The probability of intrusion attack and detection delay were measured in the simulation scenario, the result is 17% better than the current part of the exiting wired intrusion detection. Conclusion: The proposed anomaly intrusion traffic detection scheme performs better in heterogametic hybrid network (i.e., wired and wireless) compared to that of conventional homogeneous intrusion detection network models.

Highlights

The wireless networks features and its growing popularity is an obvious target for malicious attacks
The simulation of anomaly intrusion traffic detection was conducted based on the monitored traces of hybrid network traffic generated from real time data traffic from ISP servers
Intrusion detection in hybrid network presented in this study, with the statistical characteristics of data traffic and clustering the alert aggregates detect the anomaly traffic intrusion occur in the ISP most efficiently in varying time zones of multiple data transfer rate (256 kbps to 1 Mbps)

Summary

Introduction

The wireless networks features and its growing popularity is an obvious target for malicious attacks. The intrusion detection systems have been used in wired networks, but wireless networks have limited deployment. Anomaly-based detection methods with growing hacker attacks should be able to fight attacks without the need of previous and through characterization. Their application for wireless environments is more recent. The proposal presented in this work combines an intrusion detection system, which provide functional with the wired network to resistance detection of common attacks against 802.11 networks. The hackers began to use automated scripts to phone numbers randomly searched modems to access the networks could call. The attackers had to enter the network from a known point, such as a telephone number or IP address, so that at least part of that (Ohsita et al, 2007; Zubair et al, 2010)

Methods

Findings

Discussion

Conclusion