Design Of Intrusion Detection System Research Articles

Intrusion detection system design of cloud computing based on abnormal traffic identification

With the ever increasing network security risk factor, network intrusion detection information needed to solve many computational costs, timeliness of a series of technical problems. This article analysed the background of intrusion detection system, generalising the high performance network invade to examine the technique research development condition, then put forward a new intrude detection system of cloud calculate network. Using cloud computing platform, we can quickly detect anomaly network traffic and intrusion detection data. It not only extends the system administrator's security management capabilities, including security auditing, monitoring, attack recognition and traceability, but also improve information security system's integrity and availability.

An Efficient Hybrid Intrusion Detection System based on C5.0 and SVM

Nowadays, much attention has been paid to intrusion detection system (IDS) which is closely linked to the safe use of network services. Several machine-learning paradigms including neural networks, linear genetic programming (LGP), support vector machines (SVM), Bayesian networks, multivariate adaptive regression splines (MARS) fuzzy inference systems (FISs), etc. have been investigated for the design of IDS. In this paper, we develop a hybrid method of C5.0 and SVM and investigate and evaluate the performance of our proposed method with DARPA dataset. The motivation for using the hybrid approach is to improve the accuracy of the intrusion detection system when compared to using individual SVM and individual SVM.

A Semantic Approach to Host-Based Intrusion Detection Systems Using Contiguousand Discontiguous System Call Patterns

Host-based anomaly intrusion detection system design is very challenging due to the notoriously high false alarm rate. This paper introduces a new host-based anomaly intrusion detection methodology using discontiguous system call patterns, in an attempt to increase detection rates whilst reducing false alarm rates. The key concept is to apply a semantic structure to kernel level system calls in order to reflect intrinsic activities hidden in high-level programming languages, which can help understand program anomaly behaviour. Excellent results were demonstrated using a variety of decision engines, evaluating the KDD98 and UNM data sets, and a new, modern data set. The ADFA Linux data set was created as part of this research using a modern operating system and contemporary hacking methods, and is now publicly available. Furthermore, the new semantic method possesses an inherent resilience to mimicry attacks, and demonstrated a high level of portability between different operating system versions.

EFFECT OF CLUSTERING IN DESIGNING A FUZZY BASED HYBRID INTRUSION DETECTION SYSTEM FOR MOBILE AD HOC NETWORKS

Intrusion Detection System (IDS) provides additional security for the most vulnerable Mobile Adhoc Networks (MANET). Use of Fuzzy Inference System (FIS) in the design of IDS is proven to be efficient in detecting routing attacks in MANETs. Clustering is a vital means in the detection process of FIS based hybrid IDS. This study describes the design of such a system to detect black hole attack in MANET that uses Adhoc On-Demand Distance Vector (AODV) routing protocol. It analyses the effect of two clustering algorithms and also prescribes the suitable clustering algorithm for the above-mentioned IDS. MANETs with various traffic scenarios were simulated and the data set required for the IDS is extracted. A hybrid IDS is designed using Sugeno type-2 FIS to detect black hole attack. From the experimental results, it is derived that the subtractive clustering algorithm produces 97% efficient detection while FCM offers 91%. It has been found that the subtractive clustering algorithm is more fit and efficient than the Fuzzy C-Means clustering (FCM) for the FIS based detection system.

Design of Intrusion Detection System using Fuzzy Class-Association Rule Mining based on Genetic Algorithm

Now security is considered as a major issue in networks, since the network has extended dramatically. Therefore, intrusion detection systems have attracted attention, as it has an ability to detect intrusion accesses effectively. These systems identify attacks and react by generating alerts or by blocking the unwanted data/traffic. The proposed system includes fuzzy logic with a data mining method which is a class-association rule mining method based on genetic algorithm. Due to the use of fuzzy logic, the proposed system can deal with mixed type of attributes and also avoid the sharp boundary problem. Genetic algorithm is used to extract many rules which are required for anomaly detection systems. An association-rulemining method is used to extract a sufficient number of important rules for the user’s purpose rather than to extract all the rules meeting the criteria which are useful for misuse detection. Experimental results with KDD99 Cup database from MIT Lincoln Laboratory show that the proposed method provides competitively high detection rates compared with crisp data mining.

Decision tree based light weight intrusion detection using a wrapper approach

The objective of this paper is to construct a lightweight Intrusion Detection System (IDS) aimed at detecting anomalies in networks. The crucial part of building lightweight IDS depends on preprocessing of network data, identifying important features and in the design of efficient learning algorithm that classify normal and anomalous patterns. Therefore in this work, the design of IDS is investigated from these three perspectives. The goals of this paper are (i) removing redundant instances that causes the learning algorithm to be unbiased (ii) identifying suitable subset of features by employing a wrapper based feature selection algorithm (iii) realizing proposed IDS with neurotree to achieve better detection accuracy. The lightweight IDS has been developed by using a wrapper based feature selection algorithm that maximizes the specificity and sensitivity of the IDS as well as by employing a neural ensemble decision tree iterative procedure to evolve optimal features. An extensive experimental evaluation of the proposed approach with a family of six decision tree classifiers namely Decision Stump, C4.5, Naive Baye’s Tree, Random Forest, Random Tree and Representative Tree model to perform the detection of anomalous network pattern has been introduced.

Resource awareness in computational intelligence

High learning and adaptation ability of intelligent agents based on artificial neural networks (ANNs) has made them a popular tool in design and implementation of intrusion detection systems (IDS). However, ANN might consume significant resources during their retraining because of network changes. The paper investigates the design of ANN structures that may reduce the resource consumption without a substantial performance degradation. It describes the results of empirical studies examining a variety of design solutions, such as the choice of the ANN architecture and its parameters, the choice of an ANN fully connected topology versus a partial connectivity and the IDS design in a form of a hierarchical system of heterogeneous ANN-based agents. The results are analysed and design recommendations are provided. The fully connected ANN structure optimised with genetic algorithms has been found to achieve the best performance, while partial connectivity might save resources without a significant sacrifice of possible accomplishments.

Intelligent Intrusion Detection Based on Genetically Tuned Artificial Neural Networks

Artificial intelligence techniques and in particular neural networks (ANN) have been widely employed in an Intrusion Detection System (IDS) design. Due to their high learning ability, their application allows achieving higher performance in various applications. However, they can improve the resource consumption at the same time. This design goal, which is very important in a real life IDS design has received much less attention so far. The paper investigates the optimization methods of improving the ANN-based IDS performance along with the resource consumption. A particular consideration is given to partially connected neural networks that open another way of tuning the ANN structure toward the application. The study examines the choice of the connectivity ratio and its optimization with genetic algorithms. Various genetic algorithms parameters are tested in computer network attacks detection and recognition problems. The results are analyzed and IDS design recommendations are provided.

A Game Theoretical Framework on Intrusion Detection in Heterogeneous Networks

Due to the dynamic, distributed, and heterogeneous nature of today's networks, intrusion detection systems (IDSs) have become a necessary addition to the security infrastructure and are widely deployed as a complementary line of defense to classical security approaches. In this paper, we address the intrusion detection problem in heterogeneous networks consisting of nodes with different noncorrelated security assets. In our study, two crucial questions are: What are the expected behaviors of rational attackers? What is the optimal strategy of the defenders (IDSs)? We answer the questions by formulating the network intrusion detection as a noncooperative game and performing an in-depth analysis on the Nash equilibrium and the engineering implications behind. Based on our game theoretical analysis, we derive the expected behaviors of rational attackers, the minimum monitor resource requirement, and the optimal strategy of the defenders. We then provide guidelines for IDS design and deployment. We also show how our game theoretical framework can be applied to configure the intrusion detection strategies in realistic scenarios via a case study. Finally, we evaluate the proposed game theoretical framework via simulations. The simulation results show both the correctness of the analytical results and the effectiveness of the proposed guidelines.

A hybrid intrusion detection system design for computer network security

Intrusions detection systems (IDSs) are systems that try to detect attacks as they occur or after the attacks took place. IDSs collect network traffic information from some point on the network or computer system and then use this information to secure the network. Intrusion detection systems can be misuse-detection or anomaly detection based. Misuse-detection based IDSs can only detect known attacks whereas anomaly detection based IDSs can also detect new attacks by using heuristic methods. In this paper we propose a hybrid IDS by combining the two approaches in one system. The hybrid IDS is obtained by combining packet header anomaly detection (PHAD) and network traffic anomaly detection (NETAD) which are anomaly-based IDSs with the misuse-based IDS Snort which is an open-source project. The hybrid IDS obtained is evaluated using the MIT Lincoln Laboratories network traffic data (IDEVAL) as a testbed. Evaluation compares the number of attacks detected by misuse-based IDS on its own, with the hybrid IDS obtained combining anomaly-based and misuse-based IDSs and shows that the hybrid IDS is a more powerful system.

Opening the Pandora’s Box: Exploring the fundamental limitations of designing intrusion detection for MANET routing attacks

Intrusion detection is a critical component of the security framework in wireless ad hoc networks. However, the inherent properties of such networks such as the lack of infrastructure and the dynamic and decentralized nature make it extremely difficult to design effective Intrusion Detection Systems (IDS) for such environment. In this paper, we explore the major challenges posed by IDS design in ad hoc networks, and analyze the feasibility of implementing an intrusion detection system in an ad hoc network. Our analysis systematically focuses on all three major paradigms of IDS design, namely, logical rule-based techniques, probabilistic estimation based techniques as well as statistical classification techniques, and brings out the limitations of all three techniques. For illustrating the statistical limitations, a proactive ad hoc routing protocol, Optimized Link State Routing (OLSR) is used, and our analysis makes use of logical deduction as well as simulation of attacks on the OLSR protocol. The results dispel many popularly held assumptions in the literature.

An Efficient Method for Optimal Probe Deployment of Distributed IDS

A distributed network-oriented Intrusion Detection System (IDS) is a mechanism which detects misuse accesses to an intra-network by distributed IDSs on the network with decomposed attack scenarios. However, there are only ad hoc algorithms for determining a deployment of distributed IDSs and a partition of the attack scenarios. In this paper, we formally define this problem as the IDS partition deployment problem and design an efficient algorithm for a simplified version of the problem by graph theoretical techniques.

Towards the automatic generation of mobile agents for distributed intrusion detection system

The Mobile Agent Intrusion Detection System (MAIDS) is an agent based distributed Intrusion Detection System (IDS). A disciplined requirement engineering process is developed to build MAIDS. The starting point is a high level description of intrusions expressed as Software Fault Trees (SFTs). Then the SFTs are translated to Colored Petri Nets (CPNs) that specify the IDS design. Subsequently, the CPNs are implemented as software intrusion detection agents in the MAIDS agent system. By using SFT and CPN as the theoretical underpinnings, the design and implementation of MAIDS can be verified and the design and implementation errors can be substantially reduced. This paper presents a tool that automatically translates CPNs that specify IDS design into software intrusion detection agents in MAIDS. Together with the translator we have developed to convert SFTs that model intrusions into the CPN for IDS design, this tool can automatically generate intrusion detection software agents from a high level description of intrusions.

Feature deduction and ensemble design of intrusion detection systems

Current intrusion detection systems (IDS) examine all data features to detect intrusion or misuse patterns. Some of the features may be redundant or contribute little (if anything) to the detection process. The purpose of this study is to identify important input features in building an IDS that is computationally efficient and effective. We investigated the performance of two feature selection algorithms involving Bayesian networks (BN) and Classification and Regression Trees (CART) and an ensemble of BN and CART. Empirical results indicate that significant input feature selection is important to design an IDS that is lightweight, efficient and effective for real world detection systems. Finally, we propose an hybrid architecture for combining different feature selection algorithms for real world intrusion detection.