Self Tuning IDS for Changing Environment

Abstract

Intrusion detection is the problem of identifying unauthorized use, misuse, and abuse of computer systems or network resources by both system insiders and external penetrators. The proliferation of heterogeneous computer networks provides additional implications for the intrusion detection problem. The increased connectivity of computer systems gives greater access to outsiders, and makes it easier for intruders to escape from detection. IDS's are based on the belief that an intruder's behavior will be noticeably different from a legitimate user. An intrusion detection system (IDS) monitors network traffic for suspicious activity and alerts the system or network administrator. It detects and identifies unauthorized use, misuse, and abuse of computer systems from both the system insiders and external penetrators. Intrusion detection systems (IDS) are becoming essential components in a secure network environment, allowing for early detection of malicious activities and attacks. By employing information provided by IDS, it is possible to apply appropriate countermeasures techniques and mitigate attacks that would otherwise seriously undermine network security. In this paper we are proposing a techniques, which maintain the small distributed signature database and dynamically update it based on the change in network environment. Overall objective of the research work is to improve the efficiency and self configurability of the IDS in a dynamic and changing environment.