Hybrid Network Intrusion Detection Systems: A Decade’s Perspective

Abstract

With the increasing deployment of network systems, network attacks are increasing in intensity as well as complexity. Along with these increasing network attacks, many network intrusion detection techniques have been proposed which are broadly classified as being signature-based, classification-based, or anomaly-based. A deployable network intrusion detection system (NIDS) should be capable of detecting of known and unknown attacks in near real time with very low false positive rate. Supervised approaches for intrusion detection provides good detection accuracy for known attacks, but they can not detect unknown attacks. Some of the existing NIDS emphasize on unknown attack detection by using unsupervised anomaly detection techniques, but they can not distinguish network data as accurately as supervised approaches. Moreover they do not consider some other important issues like real time detection or minimization of false alarm. To overcome these problems, in the recent years many hybrid NIDS have been proposed which are basically aimed at detecting both known and unknown attacks with high accuracy of detection. In this literature review on hybrid network intrusion detection systems, we will discuss a few of the notable hybrid NIDS proposed in the recent years and will try to provide a comparative study on them.