Hybrid Intrusion Detection System using an Unsupervised method for Anomaly-based Detection

Abstract

With the advancement of network technologies, new threats and attacks have started to gain space. These have put the safety of the network at stake. These threats and attacks could be significantly detected by a Network Intrusion Detection System (NIDS). The existing NIDS makes use of classical ML algorithms that fail to detect new attacks. This happens because the traditional systems are often built on selection-based intrusion detection techniques which only detect the attacks for which they are trained for. Another intrusion detection technique is anomaly-based detection which is capable of detecting new attacks if an unsupervised method is used. But this system suffers from high false-positive rates. Hence, this work proposes such a hybrid system where a combination of signature-based detection algorithm(Decision Tree, Naive Bayes, or its variants) with an unsupervised (clustered) anomaly-based detection algorithm (DBSCAN or Isolation Forest) is used to detect both studied as well as novel attacks. The proposed work is aimed to improve the detection rate and lowering the false alarm rate.