Approach For Intrusion Detection System Research Articles

6LoWPAN: a study on QoS security threats and countermeasures using intrusion detection system approach

SUMMARYFuelled to bring the Internet of Things concept to real life, the Internet Engineering Task Force is working on 6LoWPAN, in which the standard allows a vast number of smart objects to be deployed in local wireless sensor networks (WSNs) using the huge address space of IPv6 for data and information harvesting through the Internet. From the security point of view, 6LoWPAN/WSN will be open to security threats from the local network itself and the Internet. Cryptography techniques applied as the front line of defence or deterrent can easily be broken because of the weak secure nature of LoWPAN devices and the wireless environment. Compromised nodes could lead to insider attacks without being detected by any cryptography checking. An intrusion detection system (IDS) is, primarily needed as a second line of defence to monitor the network operations and raise an alarm in case of any anomaly. This paper analyses potential security threats in 6LoWPAN and reviews the current countermeasures, in particular, the IDS‐based solutions for countering insider/internal threats. Additionally, it discovers three novel QoS‐related security threats, namely rank attack, local repair attack, and resource depleting attack, which are more seriously affecting the routing protocol for low‐power and lossy network, the routing protocol used to establish 6LoWPAN network topology. A new two‐layer IDS concept is introduced as a countermeasure method for securing the routing protocol for low‐power and lossy network‐built network topology from the internal QoS attacks. Potential research works are also presented to provide baseline reference to researchers in this field. Copyright © 2012 John Wiley & Sons, Ltd.

An ensemble design of intrusion detection system for handling uncertainty using Neutrosophic Logic Classifier

In the real world it is a routine that one must deal with uncertainty when security is concerned. Intrusion detection systems offer a new challenge in handling uncertainty due to imprecise knowledge in classifying the normal or abnormal behaviour patterns. In this paper we have introduced an emerging approach for intrusion detection system using Neutrosophic Logic Classifier which is an extension/combination of the fuzzy logic, intuitionistic logic, paraconsistent logic, and the three-valued logics that use an indeterminate value. It is capable of handling fuzzy, vague, incomplete and inconsistent information under one framework. Using this new approach there is an increase in detection rate and the significant decrease in false alarm rate. The proposed method tripartitions the dataset into normal, abnormal and indeterministic based on the degree of membership of truthness, degree of membership of indeterminacy and degree of membership of falsity. The proposed method was tested up on KDD Cup 99 dataset. The Neutrosophic Logic Classifier generates the Neutrosophic rules to determine the intrusion in progress. Improvised genetic algorithm is adopted in order to detect the potential rules for performing better classification. This paper exhibits the efficiency of handling uncertainty in Intrusion detection precisely using Neutrosophic Logic Classifier based Intrusion detection System.

Application of Relevance Vector Machines in Real Time Intrusion Detection

In the recent years, there has been a growing interest in the development of change detection techniques for the analysis of Intrusion Detection. This interest stems from the wide range of applications in which change detection methods can be used. Detecting the changes by observing data collected at different times is one of the most important applications of network security because they can provide analysis of short interval on global scale. Research in exploring change detection techniques for medium/high network data can be found for the new generation of very high resolution data. The advent of these technologies has greatly increased the ability to monitor and resolve the details of changes and makes it possible to analyze. At the same time, they present a new challenge over other technologies in that a relatively large amount of data must be analyzed and corrected for registration and classification errors to identify frequently changing trend. In this research paper an approach for Intrusion Detection System (IDS) which embeds a Change Detection Algorithm with Relevance Vector Machine (RVM) is proposed. IDS are considered as a complex task that handles a huge amount of network related data with different parameters. Current research work has proved that kernel learning based methods are very effective in addressing these problems. In contrast to Support Vector Machines (SVM), the RVM provides a probabilistic output while preserving the accuracy. The focus of this paper is to model RVM that can work with large network data set in a real environment and develop RVM classifier for IDS. The new model consists of Change Point (CP) and RVM which is competitive in processing time and improve the classification performance compared to other known classification model like SVM. The goal is to make the system simple but efficient in detecting network intrusion in an actual real time environment. Results show that the model learns more effectively, automatically adjust to the changes and adjust the threshold while minimizing the false alarm rate with timely detection.

An ensemble design of intrusion detection system for handling uncertainty using Neutrosophic Logic Classifier

In the real world it is a routine that one must deal with uncertainty when security is concerned. Intrusion detection systems offer a new challenge in handling uncertainty due to imprecise knowledge in classifying the normal or abnormal behaviour patterns. In this paper we have introduced an emerging approach for intrusion detection system using Neutrosophic Logic Classifier which is an extension/combination of the fuzzy logic, intuitionistic logic, paraconsistent logic, and the three-valued logics that use an indeterminate value. It is capable of handling fuzzy, vague, incomplete and inconsistent information under one framework. Using this new approach there is an increase in detection rate and the significant decrease in false alarm rate. The proposed method tripartitions the dataset into normal, abnormal and indeterministic based on the degree of membership of truthness, degree of membership of indeterminacy and degree of membership of falsity. The proposed method was tested up on KDD Cup 99 dataset. The Neutrosophic Logic Classifier generates the Neutrosophic rules to determine the intrusion in progress. Improvised genetic algorithm is adopted in order to detect the potential rules for performing better classification. This paper exhibits the efficiency of handling uncertainty in Intrusion detection precisely using Neutrosophic Logic Classifier based Intrusion detection System.

A novel intrusion detection system by using intelligent data mining in weka environment

Nowadays, the using of intelligent data mining approaches to predict intrusion in local area networks has been increasing rapidly. In this paper, an improved approach for Intrusion Detection System (IDS) based on combining data mining and expert system is presented and implemented in WEKA. The taxonomy consists of a classification of the detection principle as well as certain WEKA aspects of the intrusion detection system such as open-source data mining. The combining methods may give better performance of IDS systems, and make the detection more effective. The result of the evaluation of the new design produced a better result in terms of detection efficiency and false alarm rate from the existing problems. This presents useful information in intrusion detection.

LAN attack detection using Discrete Event Systems

Address Resolution Protocol (ARP) is used for determining the link layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IP–MAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IP–MAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IP–MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IP–MAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IP–MAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IP–MAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed.

Modeling intrusion detection system using hybrid intelligent systems

The process of monitoring the events occurring in a computer system or network and analyzing them for sign of intrusions is known as intrusion detection system (IDS). This paper presents two hybrid approaches for modeling IDS. Decision trees (DT) and support vector machines (SVM) are combined as a hierarchical hybrid intelligent system model (DT–SVM) and an ensemble approach combining the base classifiers. The hybrid intrusion detection model combines the individual base classifiers and other hybrid machine learning paradigms to maximize detection accuracy and minimize computational complexity. Empirical results illustrate that the proposed hybrid systems provide more accurate intrusion detection systems.