Accuracy Of Intrusion Detection Research Articles

Visual analytics for intrusion detection in spam emails

Spam email attacks are increasing at an alarming rate and have become more and more cunning in nature. This has necessitated the need for visual spam email analysis within an intrusion detection system to identify these attacks. The challenges are how to increase the accuracy of detection and how to visualise large volumes of spam email to better understand the analysis results and identify email attacks. This paper proposes a Density-Weight model that is to strengthen and extend the system capacity for analysis of network attacks in spam emails, including DDoS attacks. An interactive visual clustering method DA-TU is introduced to classify and display spam emails. The experimental results have shown that the proposed new model has improved the accuracy of intrusion detection and provides a better understanding of the nature of spam email attacks on though the network.

Hybrid model of self‐organizing map and kernel auto‐associator for internet intrusion detection

PurposeThe task of internet intrusion detection is to detect anomalous network connections caused by intrusive activities. There have been many intrusion detection schemes proposed, most of which apply both normal and intrusion data to construct classifiers. However, normal data and intrusion data are often seriously imbalanced because intrusive connection data are usually difficult to collect. Internet intrusion detection can be considered as a novelty detection problem, which is the identification of new or unknown data, to which a learning system has not been exposed during training. This paper aims to address this issue.Design/methodology/approachIn this paper, a novelty detection‐based intrusion detection system is proposed by combining the self‐organizing map (SOM) and the kernel auto‐associator (KAA) model proposed earlier by the first author. The KAA model is a generalization of auto‐associative networks by training to recall the inputs through kernel subspace. For anomaly detection, the SOM organizes the prototypes of samples while the KAA provides data description for the normal connection patterns. The hybrid SOM/KAA model can also be applied to classify different types of attacks.FindingsUsing the KDD CUP, 1999 dataset, the performance of the proposed scheme in separating normal connection patterns from intrusive connection patterns was compared with some state‐of‐art novelty detection methods, showing marked improvements in terms of the high intrusion detection accuracy and low false positives. Simulations on the classification of attack categories also demonstrate favorable results of the accuracy, which are comparable to the entries from the KDD CUP, 1999 data mining competition.Originality/valueThe hybrid model of SOM and the KAA model can achieve significant results for intrusion detection.

Study on Genetic Algorithm Optimization for Support Vector Machine in Network Intrusion Detection

Abstract This paper studies on methods taken in solving the existing network disorders in network intrusion detection. Traditional parameter-optimized Support Vector Machine (SVM) may easily generate improper parameter-selections, and may further lead to a low accuracy in network intrusion detection. In order to overcome such problems, so well as to ensure the network security, this paper tries to put forward with a Genetic Algorithm optimized Support Vector Machine in network intrusion detection. For this purpose, some procedures have to be taken. Firstly the network intrusion data should be normalized and simplified for inputs, and then to obtain optimal parameters through the parameteroptimization for SVM with a Genetic Algorithm; Finally to get network intrusion results through detecting the network data normalized by an optimal Support Vector Machine (SVM) model. The simulating results show that, compared with the traditional network intrusion detection methods, the optimized Support Vector Machine (SVM) model with a Genetic Algorithm has a high accuracy, and a low rate of losing or false alarms, and is proved to be effective in network intrusion detection.

Research on Firewall System for Confidential Network

To satisfy the special needs of confidential networks, a protection method of combining ingress and egress access control for network boundary security is proposed. In preventing network attacks, a combined mechanism of packets filtering firewall and intrusion detection system based on artificial neural network and rule matching is implemented to increase the accuracy of intrusion detection. In preventing information leakage, techniques of identity authentication and content filtering are integrated into the mechanism of egress access control so that strategies with more flexibility in security auditing and access control can be implemented, which is effective to prevent the sensitive or secret data from leaking out and to trace the source of leakage.

An Improved Artificial Immune System-Based Network Intrusion Detection by Using Rough Set

With theincreasing worldwide network attacks, intrusion detection (ID) hasbecome a popularresearch topic inlast decade.Several artificial intelligence techniques such as neural networks and fuzzy logichave been applied in ID. The results are varied. Theintrusion detection accuracy is themain focus for intrusion detection systems (IDS). Most research activities in the area aiming to improve the ID accuracy. In this paper, anartificial immune system (AIS) based network intrusion detection scheme is proposed. An optimized feature selection using Rough Set (RS) theory is defined. The complexity issue is addressed in the design of the algorithms. The scheme is tested on the widely used KDD CUP 99 dataset. The result shows that theproposed scheme outperforms other schemes in detection accuracy.

FuzMet: a fuzzy‐logic based alert prioritization engine for intrusion detection systems

SUMMARYIntrusion detection systems (IDSs) are designed to monitor a networked environment and generate alerts whenever abnormal activities are detected. The number of these alerts can be very large, making their evaluation by security analysts a difficult task. Management is complicated by the need to configure the different components of alert evaluation systems. In addition, IDS alert management techniques, such as clustering and correlation, suffer from involving unrelated alerts in their processes and consequently provide results that are inaccurate and difficult to manage. Thus the tuning of an IDS alert management system in order to provide optimal results remains a major challenge, which is further complicated by the large spectrum of potential attacks the system can be subject to. This paper considers the specification and configuration issues of FuzMet, a novel IDS alert management system which employs several metrics and a fuzzy‐logic based approach for scoring and prioritizing alerts. In addition, it features an alert rescoring technique that leads to a further reduction in the number of alerts. Comparative results between SNORT scores and FuzMet alert prioritization onto a real attack dataset are presented, along with a simulation‐based investigation of the optimal configuration of FuzMet. The results prove the enhanced intrusion detection accuracy brought by our system. Copyright © 2011 John Wiley & Sons, Ltd.

Intrusion detection using neural based hybrid classification methods

Data mining is the use of algorithms to extract the information and patterns derived by the knowledge discovery in databases process. Classification is a very common data mining task. Classification maps data into predefined groups or classes. It is often referred to as supervised learning because the classes are determined before examining the data. Due to increasing incidents of cyber attacks, building effective intrusion detection systems are essential for protecting information systems security, and yet it remains an elusive goal and a great challenge. This paper presents two classification methods involving multilayer perceptron and radial basis function and an ensemble of multilayer perceptron and radial basis function. We propose hybrid architecture involving ensemble and base classifiers for intrusion detection systems. The analysis of results shows that the performance of the proposed method is superior to that of single usage of existing classification methods such as multilayer perceptron and radial basis function. Additionally it has been found that ensemble of multilayer perceptron is superior to ensemble of radial basis function classifier for normal behavior and reverse is the case for abnormal behavior. We show that the proposed method provides significant improvement of prediction accuracy in intrusion detection.

Fast intrusion detection based on a non-negative matrix factorization model

In this paper, we present an efficient fast anomaly intrusion detection model incorporating a large amount of data from various data sources. A novel method based on non-negative matrix factorization (NMF) is presented to profile program and user behaviors of a computer system. A large amount of high-dimensional data is collected in our experiments and divided into smaller data blocks by a specific scheme. The system call data is divided into blocks by processes, while command data is divided into consecutive blocks with a fixed length. The frequencies of individual elements in each block of data are computed and placed column by column as data vectors to construct a matrix representation. NMF is employed to reduce the high-dimensional data vectors and anomaly detection can be realized as a very simple classifier in low dimensions. Experimental results show that the model presented in this paper is promising in terms of detection accuracy, computation efficiency and implementation for fast intrusion detection.

Learning vector quantization neural network method for network intrusion detection

A new intrusion detection method based on learning vector quantization (LVQ) with low overhead and high efficiency is presented. The computer vision system employs LVQ neural networks as classifier to recognize intrusion. The recognition process includes three stages: 1 feature selection and data normalization processing; 2 learning the training data selected from the feature data set; 3 identifying the intrusion and generating the result report of machine condition classification. Experimental results show that the proposed method is promising in terms of detection accuracy, computational expense and implementation for intrusion detection.

The Design and Implementation of a Self-Healing Database System

In this paper, we present the design and implementation of ITDB, a self-healing or intrusion-tolerant database prototype system. While traditional secure database systems rely on preventive controls and are very limited in surviving malicious attacks, ITDB can detect intrusions, isolate attacks, contain, assess, and repair the damage caused by intrusions in a timely manner such that sustained, self-stabilized levels of data integrity and availability can be provided to applications in the face of attacks. ITDB is implemented on top of a COTS DBMS. We have evaluated the cost effectiveness of ITDB using several micro-benchmarks. Preliminary testing measurements suggest that when the accuracy of intrusion detection is satisfactory, ITDB can effectively locate and repair the damage on-the fly with reasonable (database) performance penalty.

The neural network models for IDS based on the asymmetric costs of false negative errors and false positive errors

Abstract This paper investigates the asymmetric costs of false positive and negative errors to enhance the IDS performance. The proposed method utilizes the neural network model to consider the cost ratio of false negative errors to false positive errors. Compared with false positive errors, false negative errors incur a greater loss to organizations which are connected to the systems by networks. This method is designed to accomplish both security and system performance objectives. The results of our empirical experiment show that the neural network model provides high accuracy in intrusion detection. In addition, the simulation results show that the effectiveness of intrusion detection can be enhanced by considering the asymmetric costs of false negative and false positive errors.