R2L Attacks Research Articles

Intrusion Detection System with Multi Layer using Bayesian Networks

the era of network security, intrusion detection system plays a vital to detect real - time intrusions, and to execute work to stop the attack. Being everything shifting to internet, security became the foremost preference. In real world, the minority attacks R2L (Remote-To-User) and U2R (User-To- Root) are more hazardous than Probe and DoS (Denial-Of- Service) majority attacks. Present IDS are not much efficient to detect these low level attacks. Therefore, it is extremely important to improve the detection performance for the R2L and U2R attacks with the majority attacks. In this paper hierarchical layered approach for improving detection rate of minority attacks as well as majority attacks is propound. The propound model used Naive bayes classifier with K2 learning process on reduced NSL KDD dataset for each attack class. In this method every layer is individually trained to detect a single type of attack category and the outcome of one layer is passed into another layer to increase the detection rate and for better categorization of both the majority and minority attacks. Intrusion detection system (IDS), Network security, Feature selection, naive bayes classifier, R2U, U2R, DoS 1. INTRODUCTIONNetwork Security Can be defined as It is the set of guidelines adopted by a Network administrator to prevent the unauthorized access, modification and misuse of the network traffic by attackers.ID (Intrusion Detection) techniques are used to strength security and increase resistance to internal and external attacks. With the Increase in Technology the chance of malware and Intrusions get increase. The firewalls do not provide much security. In order to inspect network traffic many corporation are using proactive and reactive both types of IDS system. The goal of the intrusion detection system is to monitor and control the network traffic to prevent the numerous types of intrusion attempt. When an intrusion detection system is deployed, it provides warning to the users indicating that system is under attack. These warnings can help users to prevent the attack by increasing resistance to attack.

Evaluating the Strengths and Weaknesses of Mining Audit Data for Automated Models for Intrusion Detection in <i>Tcpdump</i> and Basic Security Module Data

Problem statement: Intrusion Detection System (IDS) have become an important component of infrastructure protection mechanism to secure the current and emerging networks, its services and applications by detecting, alerting and taking necessary actions against the malicious activities. The network size, technology diversities and security policies make networks more challenging and hence there is a requirement for IDS which should be very accurate, adaptive, extensible and more reliable. Although there exists the novel framework for this requirement namely Mining Audit Data for Automated Models for Intrusion Detection (MADAM ID), it is having some performance shortfalls in processing the audit data. Approach: Few experiments were conducted on tcpdump data of DARPA and BCM audit files by applying the algorithms and tools of MADAM ID in the processing of audit data, mine patterns, construct features and build RIPPER classifiers. By putting it all together, four main categories of attacks namely DOS, R2L, U2R and PROBING attacks were simulated. Results: This study outlines the experimentation results of MADAM ID in testing the DARPA and BSM data on a simulated network environment. Conclusion: The strengths and weakness of MADAM ID has been identified thru the experiments conducted on tcpdump data and also on Pascal based audit files of Basic Security Module (BSM). This study also gives some additional directions about the future applications of MADAM ID.

A Combined Anomaly Base Intrusion Detection Using Memetic Algorithm and Bayesian Networks

Anomaly base intrusion detection systems (IDSs) detection rate trend and enjoy relatively numerous false negatives and false positives. In this study, we aim to achieve a linear classification function using Memtic algorithm, to minimize errors of such IDSs and to improve such systems, as well. A combined system is offered in this paper which tries to find the optimum subset for detecting intrusion of any set of four attack classes of Knowledge Discovery in Database 99 (KDD99) by using of both correlation analysis amongst features and information theory. Then proper classification function is measured for each attack class through a Memetic algorithm. Bayesian networks are employed to combine results of any function in order to achieve the final classification. Kdd99 dataset and its refined version, NSL-kdd, were used to estimate the offered system, our findings showed 93.42 detection rate. Likewise, NSL-kdd estimation shows the suggested system for R2L attack class has succeeded to classify 86.60% of records which have not been classified correctly by the previous algorithms.

Layered Approach Using Conditional Random Fields for Intrusion Detection

Intrusion detection faces a number of challenges; an intrusion detection system must reliably detect malicious activities in a network and must perform efficiently to cope with the large amount of network traffic. In this paper, we address these two issues of Accuracy and Efficiency using Conditional Random Fields and Layered Approach. We demonstrate that high attack detection accuracy can be achieved by using Conditional Random Fields and high efficiency by implementing the Layered Approach. Experimental results on the benchmark KDD '99 intrusion data set show that our proposed system based on Layered Conditional Random Fields outperforms other well-known methods such as the decision trees and the naive Bayes. The improvement in attack detection accuracy is very high, particularly, for the U2R attacks (34.8 percent improvement) and the R2L attacks (34.5 percent improvement). Statistical Tests also demonstrate higher confidence in detection accuracy for our method. Finally, we show that our system is robust and is able to handle noisy data without compromising performance.

Anomaly intrusion detection based on genetic optimization and fuzzy rules mining

A genetic-fuzzy rule mining approach applied to anomaly intrusion detection was proposed, with an Agent-based evolutionary computing framework. Due to the exchanging of fuzzy sets information among the fuzzy sets Agents, accurate and interpretable fuzzy IF-THEN rules could be extracted from network traffic data for optimizing the interpretability and improving the compactivity of the fuzzy systems, by using three strategies including fuzzy sets distribution, interpretable regulation and fuzzy rules generation. All the training and testing datasets were based on the KDD CUP 99 intrusion detection benchmark data set. Compared with the current methods, the experimental results show that the proposed approach can provide higher detection accuracy and lower false alarm rate for DoS, Probe and U2R attacks with a slightly poorer performance for R2L attacks.

A new dependency and correlation analysis for features

The quality of the data being analyzed is a critical factor that affects the accuracy of data mining algorithms. There are two important aspects of the data quality, one is relevance and the other is data redundancy. The inclusion of irrelevant and redundant features in the data mining model results in poor predictions and high computational overhead. This paper presents an efficient method concerning both the relevance of the features and the pairwise features correlation in order to improve the prediction and accuracy of our data mining algorithm. We introduce a new feature correlation metric Q/sub Y/(X/sub i/,X/sub j/) and feature subset merit measure e(S) to quantify the relevance and the correlation among features with respect to a desired data mining task (e.g., detection of an abnormal behavior in a network service due to network attacks). Our approach takes into consideration not only the dependency among the features, but also their dependency with respect to a given data mining task. Our analysis shows that the correlation relationship among features depends on the decision task and, thus, they display different behaviors as we change the decision task. We applied our data mining approach to network security and validated it using the DARPA KDD99 benchmark data set. Our results show that, using the new decision dependent correlation metric, we can efficiently detect rare network attacks such as User to Root (U2R) and Remote to Local (R2L) attacks. The best reported detection rates for U2R and R2L on the KDD99 data sets were 13.2 percent and 8.4 percent with 0.5 percent false alarm, respectively. For U2R attacks, our approach can achieve a 92.5 percent detection rate with a false alarm of 0.7587 percent. For R2L attacks, our approach can achieve a 92.47 percent detection rate with a false alarm of 8.35 percent.