Intrusion Detection Mechanism Research Articles

CUSUM-Based Intrusion Detection Mechanism for Wireless Sensor Networks

The nature of wireless sensor networks (WSNs) makes them very vulnerable to adversary's malicious attacks. Therefore, network security is an important issue to WSNs. Due to the constraints of WSN, intrusion detection in WSNs is a challengeable task. In this paper, we present a novel intrusion detection mechanism for WSNs, which is composed of a secure data communication algorithm and an intrusion detection algorithm. The major contribution of this paper is that we propose an original secure mechanism to defend WSNs against malicious attacks by using the information generated during data communication. The approach is able to protect the data communication in a WSN even if some sensor nodes are compromised by adversary. The proposed approach is easy to be implemented and performed in resource-constrained WSN. We also evaluate the proposed approach by a simulation experiment and analyze the simulation results in detail.

Comparative Study of Ids for Manet

Recent advancements in wireless communication and the miniaturization of computers have led to a new concept called the mobile ad hoc network (MANET), where two or more mobile nodes can form a temporary network without need of any existing network infrastructure or centralized administration. Even if the source and the destination mobile hosts are not in the communication range of each other, data packets are forwarded to the destination mobile host by relaying the transmission through other mobile hosts which exist between the two mobile hosts. Since no special infrastructure is required, in various fields such as military and rescue affairs, many applications are expected to be developed for ad hoc networks. Nevertheless, the exposed medium and wide distribution of nodes make MANET vulnerable to malicious attackers. In this situation, it is necessary to develop efficient intrusion-detection mechanisms to protect MANET from attacks. Since MANETs is used in many applications it isnecessary to provide more security. In this paper, we suggest and implement a new intrusion-detection system named Enhanced Adaptive Acknowledgment (EAACK) with cluster based communicationspecifically designed for MANETs. Compared to current approaches, EAACK with cluster based communication demonstrates higher malicious-behavior-detection rates in certain environments.

Intrusion Detection in MANET using Neural Networks and ZSBT

ad-hoc network is a collection of mobile nodes that organize themselves into a network without any predefined infrastructure. The characteristics of MANET are dynamic topology; bandwidth and energy constrained and limited physical security. Due to the dynamic nature of the network, these networks can be easily vulnerable to attacks. Many type of attacks can threat the MANET and the classification of attacks are Black hole, Routing loops, Network partition, Selfishness, Sleep deprivation and Denial of Service. The MANET is mainly applied in military environments, personal area networking and emergency operations. This work provides a technique to improve the security level of MANET. The mechanism of intrusion detection is designed in MANET on the basis of artificial neural networks (ANNs) and Zone- Sampling Based Trace back algorithm (ZSBT) for detecting DOS attacks. Intrusion detection system is a type of security management system for computers and networks. The prevention mechanisms are thwarted by the ability of attackers to forge, or spoof, the source addresses in IP packets. By employing IP spoofing, attackers can evade from detection. But with the help of IDPF, the attacker node can be identified easily and it also has the ability to limit the IP spoofing capability. Artificial neural network and ZSBT modeling uses simulated MANET environments for detecting nodes under DOS attack effectively. But the ZSBT method works well for detecting DoS attacks in the network when compared with ANN methods.

False Alarm Reduction Using Adaptive Agent-Based Profiling

In this paper the authors propose a new efficient anomaly-based intrusion detection mechanism based on multi-agent systems. New networks are particularly vulnerable to intrusion, they are often attacked with intelligent and skilful hacking techniques. The intrusion detection techniques have to deal with two problems: intrusion detection and false alarms. The issue of false alarms has an important impact on the success of the anomaly-based intrusion detection technologies. The purpose of this paper is to improve their accuracy by detecting real attacks and by reducing the number of unnecessary generated alerts. The authors' intrusion detection mechanism relies on a set of agents to ensure the detection and the adaptation of normal profile to support the legitimate dynamic changes that occur and are the cause of high rate of false alarms.

A survey on security and privacy issues inWireless Mesh Networks

AbstractWireless Mesh Networks are considered as a promising solution for offering low‐cost access to broadband services. However, one of the main challenges in the design of these networks is their vulnerability to security attacks. In this paper, we analyze the fundamental security challenges and constraints of these networks, classify several possible attacks, and survey several intrusion prevention, detection, and response mechanisms found in the literature. Copyright © 2013 John Wiley & Sons, Ltd.

An intrusion detection & adaptive response mechanism for MANETs

Mobile ad hoc networks are vulnerable to a variety of network layer attacks such as black hole, gray hole, sleep deprivation & rushing attacks. In this paper we present an intrusion detection & adaptive response mechanism for MANETs that detects a range of attacks and provides an effective response with low network degradation. We consider the deficiencies of a fixed response to an intrusion; and we overcome these deficiencies with a flexible response scheme that depends on the measured confidence in the attack, the severity of attack and the degradation in network performance. We present results from an implementation of the response scheme that has three intrusion response actions. Simulation results show the effectiveness of the proposed detection and adaptive response mechanisms in various attack scenarios. An analysis of the impact of our proposed scheme shows that it allows a flexible approach to management of threats and demonstrates improved network performance with a low network overhead.

Conflicts between Intrusion Detection and Privacy Mechanisms for Wireless Sensor Networks

Both active and passive attackers pose a threat for wireless sensor networks. So, intrusion detection systems and privacy mechanisms must be deployed, usually at the same time. Yet this coexistence might result in the malfunction or inefficiency of one of these components. Several techniques and principles can help minimize such problems.

A Novel Method for Intrusion Detection Based on SARSA and Radial Bias Feed Forward Network (RBFFN)

The Internet, computer networks and information are vital resources of current information trend and their protection has increased importance in current existence. Any attempt, successful or unsuccessful to finding the middle ground the discretion, truthfulness and accessibility of any information resource or the information itself is measured a security attack or an intrusion. Intrusion compromised a loose of information credential and trust of security concern. The mechanism of intrusion detection faced a problem of new generated schema and pattern of attack data. Various authors and researchers proposed a method for intrusion detection based on machine learning approach and neural network approach all these compromised with new pattern and schema. Now in this paper a new model of intrusion detection based on SARAS reinforced learning scheme and RBF neural network has proposed. SARAS method imposed a state of attack behaviour and RBF neural network process for training pattern for new schema. Our empirical result shows that the proposed model is better in compression of SARSA and other machine learning technique.

A swarm-based efficient distributed intrusion detection system for mobile ad hoc networks (MANET)

In mobile ad hoc network (MANET), the issues such as limited bandwidth availability, dynamic connectivity and so on cause the process of intrusion detection to be more complex. The nodes that monitor the malicious nodes should have necessary residual bandwidth and energy and should be trustable. In order to overcome these drawbacks, in this paper, we propose a swarm-based efficient distributed intrusion detection system for MANET. In this technique, swarm agents are utilised to select the nodes with highest trust value, residual bandwidth and residual energy as active nodes. Each active node monitors its neighbour nodes within its transmission range and collects the trust value from all monitored nodes. The active nodes adaptively change as per the trust thresholds. Upon collaborative exchange of the trust values of the monitored nodes among the active nodes, if the active node finds any node below a minimum trust threshold, then the node is marked as malicious. When the source receives alert message about the malicious node, a defence technique is deployed to filter the corresponding malicious node from the network. By simulation results, we show that the proposed approach is efficient intrusion detection mechanism for MANET.

EAACK—A Secure Intrusion-Detection System for MANETs

The migration to wireless network from wired network has been a global trend in the past few decades. The mobility and scalability brought by wireless network made it possible in many applications. Among all the contemporary wireless networks, Mobile Ad hoc NETwork (MANET) is one of the most important and unique applications. On the contrary to traditional network architecture, MANET does not require a fixed network infrastructure; every single node works as both a transmitter and a receiver. Nodes communicate directly with each other when they are both within the same communication range. Otherwise, they rely on their neighbors to relay messages. The self-configuring ability of nodes in MANET made it popular among critical mission applications like military use or emergency recovery. However, the open medium and wide distribution of nodes make MANET vulnerable to malicious attackers. In this case, it is crucial to develop efficient intrusion-detection mechanisms to protect MANET from attacks. With the improvements of the technology and cut in hardware costs, we are witnessing a current trend of expanding MANETs into industrial applications. To adjust to such trend, we strongly believe that it is vital to address its potential security issues. In this paper, we propose and implement a new intrusion-detection system named Enhanced Adaptive ACKnowledgment (EAACK) specially designed for MANETs. Compared to contemporary approaches, EAACK demonstrates higher malicious-behavior-detection rates in certain circumstances while does not greatly affect the network performances.

A Survey of MANET Intrusion Detection & Prevention Approaches for Network Layer Attacks

In the last decade, mobile ad hoc networks (MANETs) have emerged as a major next generation wireless networking technology. However, MANETs are vulnerable to various attacks at all layers, including in particular the network layer, because the design of most MANET routing protocols assumes that there is no malicious intruder node in the network. In this paper, we present a survey of the main types of attack at the network layer, and we then review intrusion detection and protection mechanisms that have been proposed in the literature. We classify these mechanisms as either point detection algorithms that deal with a single type of attack, or as intrusion detection systems (IDSs) that can deal with a range of attacks. A comparison of the proposed protection mechanisms is also included in this paper. Finally, we identify areas where further research could focus.

Analyzing Log Files for Postmortem Intrusion Detection

Upon an intrusion, security staff must analyze the IT system that has been compromised, in order to determine how the attacker gained access to it, and what he did afterward. Usually, this analysis reveals that the attacker has run an exploit that takes advantage of a system vulnerability. Pinpointing, in a given log file, the execution of one such an exploit, if any, is very valuable for computer security. This is both because it speeds up the process of gathering evidence of the intrusion, and because it helps taking measures to prevent a further intrusion, e.g., by building and applying an appropriate attack signature for intrusion detection system maintenance. This problem, which we call postmortem intrusion detection, is fairly complex, given both the overwhelming length of a standard log file, and the difficulty of identifying exactly where the intrusion has occurred. In this paper, we propose a novel approach for postmortem intrusion detection, which factors out repetitive behavior, thus, speeding up the process of locating the execution of an exploit, if any. Central to our intrusion detection mechanism is a classifier, which separates abnormal behavior from normal one. This classifier is built upon a method that combines a hidden Markov model with <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> -means. Our experimental results establish that our method is able to spot the execution of an exploit, with a cumulative detection rate of over 90%. In addition, we propose an entropy-based approach that speeds up the construction of a profile for ordinary system behavior.

A Software of Intrusion Detection Mechanism for Virtual Platforms

A Software of Intrusion Detection Mechanism for Virtual Platforms

RDACIA Runtime Defence Against Code Injection Attack Using N-Variant Approach

Software vulnerabilities have been a major threat for decades. Security vulnerabilities in software permit attackers to compromise and misuse computer systems for various malicious purposes. Intrusion detection systems have an important role in detecting and disrupting attacks before they can compromise software. Multi- variant execution is an intrusion detection mechanism that executes several slightly different versions or variants of the same program in lockstep. The variants are built to have identical behavior under normal execution conditions. However, when the variants are under attack, there are detectable differences in their execution behavior. At run time, a monitor compares the behavior of the variants at certain synchronization points and raises an alarm when a discrepancy is detected. We present a monitoring mechanism that does not need any kernel privileges to supervise the variants. As a result, the monitor runs entirely in user space. Our experiments show that the multi-variant execution technique is effective in detecting and preventing code injection attacks.

A survivability model in wireless sensor networks

In this paper, we present a survivability evaluation model and analyze the performance of Wireless Sensor Networks (WSNs) under attack and key compromise. First, we present a survivability evaluation model of WSNs by representing the states of WSNs under attack. Here, the survivability of WSNs is expressed as a continuous time Markov Chain to describe the status of real WSNs. We propose a threshold condition to trigger the transition between the states of WSNs in the face of DoS attack. According to the threshold conditions, the survivability model is capable of taking action(s) and enables the formalization of the effect of action(s). We present an analytical model and numerical analysis to show the feasibility of our work in terms of availability, survivability, and cost.Second, we present a survivability model and evaluation of WSNs under key compromise. Sensor nodes in a network can be captured by an adversary. The compromised node can be identified by one of the intrusion detection mechanisms. After detecting the compromised node, the key in the node has to be revoked. In this paper, we present the effect of key compromise and key revocation in WSNs. We additionally present a survivability evaluation model using the SHARPE simulation tool in terms of availability.

LEACH 프로토콜에 적합한 명세기반 침입탐지 기법

With the improvement of wireless communication and embedded technology, WSN is used at various fields. Meanwhile, because WSN is resource constrained, it is more vulnerable than other networks. To solve the security problem of WSN, we can use the traditional secure mechanism like as cryptography and authentication. But the traditional secure mechanism is not enough for all security issues that may be happened in WSN, especially attacks caused by the compromised node. So, we need the IDS as the second secure mechanism for WSN. In this paper, we propose the Specification-based Intrusion Detection Mechanism that makes LEACH, which is one of the clustering routing protocol for WSN, more reliable and safety.

Network intrusion detection using hybrid binary PSO and random forests algorithm

AbstractNetwork security risks grow with increase in the network size. In recent past, the attacks on computer networks have increased tremendously and require efficient network intrusion detection mechanisms. Data mining and machine‐learning techniques have been used for network intrusion detection during the past few years and have gained much popularity. In this paper, we propose an intrusion detection mechanism based on binary particle swarm optimization (PSO) and random forests (RF) algorithms called PSO‐RF and investigate the performance of various dimension reduction techniques along with a set of different classifiers including the proposed approach. Binary PSO is used to find more appropriate set of attributes for classifying network intrusions, and RF is used as a classifier. In the preprocessing step, we reduce the dimensions of the dataset by using different state‐of‐the‐art dimension reduction techniques, and then this reduced dataset is presented to the proposed PSO‐RF approach that further optimizes the dimensions of the data and finds an optimal set of features. PSO is an optimization method that has a strong global search capability and is used here for dimension optimization. We perform extensive experimentation to prove the worth of the proposed approach by using different performance metrics. The standard benchmark, that is, KDD99Cup dataset, is used that contains the information about various kinds of network intrusions. The experimental results indicate that the proposed approach performs better than the other approaches for the detection of all kinds of attacks present in the dataset. Copyright © 2012 John Wiley &amp; Sons, Ltd.

Intrusion detection for resource-constrained embedded control systems in the power grid

The power grid depends on embedded control systems or SCADA systems to function properly. Securing these systems presents unique challenges—in addition to the resource restrictions inherent to embedded devices, SCADA systems must accommodate strict timing requirements that are non-negotiable, and their massive scale greatly amplifies costs such as power consumption. Together, these constraints make the conventional approach to host intrusion detection–using a hypervisor to create a safe environment from which a monitoring entity can operate–too costly or impractical for embedded control systems in the critical infrastructure.This paper discusses the design and implementation of Autoscopy, an experimental host-based intrusion detection mechanism that operates from within the kernel and leverages its built-in tracing framework to identify control-flow anomalies, which are most often caused by rootkits that hijack kernel hooks. The paper presents the concepts underlying the original Autoscopy prototype, highlights some of the issues that arose from it, and introduces the new system, dubbed Autoscopy Jr., which addresses the issues. Tests on non-embedded systems demonstrated that the monitoring scope could be managed to limit Autoscopy Jr.’s performance impact on its host to under 5%. The paper also describes the use of an optimized probe framework to reduce overhead and the test results obtained for a hardened kernel. The results demonstrate that Autoscopy Jr.’s design and effectiveness render it uniquely suited to intrusion detection for SCADA systems.

Intrusion Detection Technique in Mobile Adhoc Network Based on Quantitative Approach

In this paper ,we study the types of attacks in intrusion detection system in Mobile Ad Hoc network(MANET).Mobile Adhoc Networks are a relatively new and rapidly evolving area of interests. One such field concerns mobile adhoc networks (MANETs) in which mobile nodes organize themselves in a network without the help of any predefined infrastructure. Securing MANETs is an important part of deploying and utilizing them, since they are often used in critical applications where data and communications integrity in important. Many solution for intrusion detection in wireless environments have been developed but these solution may not always be sufficient, as ad-hoc networks have their own vulnerabilities that cannot be addressed by these solutions. In this paper traditional security algorithms coupled with intrusion detection mechanism. Here we using a quantitative method to detect intrusion in MANETS with mobile nodes. Our method is a behavioral anomaly based system, which makes it dynamic, scalable, configurable and robust. For simulating our mobile nodes use AODV (Adhoc on demand distance Vector)routing. It is observed that the malicious node detection rate is very good and false positive detection rate is slow.

An agent based business aware incident detection system for cloud environments

Classic intrusion detection mechanisms are not flexible enough to cope with cloud specific characteristics such as frequent infrastructure changes. This makes them unable to address new cloud specific security issues. In this paper we introduce the cloud incident detection system Security Audit as a Service (SAaaS). It is built upon intelligent autonomous agents, which are aware of underlying business driven intercommunication of cloud services. This enables the presented SAaaS architecture to be flexible and to supported cross customer event monitoring within a cloud infrastructure. A contribution of this paper it to provide a high-level design of the SAaaS architecture, an introduction into the proposed Security Business Flow Language (SBFL), a first prototype of an autonomous agent and an evaluation about, which cloud specific security problems are addressed by the presented architecture. It is shown that autonomous agents and behaviour analysis are fertile approaches to detect cloud specific security problems and can create a cloud audit system.