Intrusion detection in computer networks by a modular ensemble of one-class classifiers

Since the early days of research on intrusion detection, anomaly-based approaches have been proposed to detect intrusion attempts. Attacks are detected as anomalies when compared to a model of normal (legitimate) events. Anomaly-based approaches typically produce a relatively large number of false alarms compared to signature-based IDS. However, anomaly-based IDS are able to detect never-before-seen attacks. As new types of attacks are generated at an increasing pace and the process of signature generation is slow, it turns out that signature-based IDS can be easily evaded by new attacks. The ability of anomaly-based IDS to detect attacks never observed in the wild has stirred up a renewed interest in anomaly detection. In particular, recent work focused on unsupervised or unlabeled anomaly detection, due to the fact that it is very hard and expensive to obtain a labeled dataset containing only pure normal events.The unlabeled approaches proposed so far for network IDS focused on modeling the normal network traffic considered as a whole. As network traffic related to different protocols or services exhibits different characteristics, this paper proposes an unlabeled Network Anomaly IDS based on a modular Multiple Classifier System (MCS). Each module is designed to model a particular group of similar protocols or network services. The use of a modular MCS allows the designer to choose a different model and decision threshold for different (groups of) network services. This also allows the designer to tune the false alarm rate and detection rate produced by each module to optimize the overall performance of the ensemble. Experimental results on the KDD-Cup 1999 dataset show that the proposed anomaly IDS achieves high attack detection rate and low false alarm rate at the same time.     

Privacy issues in intrusion detection systems: A taxonomy,survey and future directions

Intrusion Detection Systems (IDSs) detect potential attacks by monitoring activities in computers and networks. This monitoring is carried out by collecting and analyzing data pertaining to users and organizations. The data is collected from various sources – such as system log files or network traffic–and may contain private information. Therefore, analysis of the data by an IDS can raise multiple privacy concerns. Recently, building IDSs that consider privacy issues in their design criteria in addition to classic design objectives (such as IDS’ performance and precision) has become a priority. This article proposes a taxonomy of privacy issues in IDSs which is then utilized to identify new challenges and problems in the field. In this taxonomy, we classify privacy-sensitive IDS data as input, built-in and generated data. Research prototypes are then surveyed and compared using the taxonomy. The privacy techniques used in the surveyed systems are discussed and compared based on their effects on the performance and precision of the IDS. Finally, the taxonomy and the survey are used to point out a number of areas for future research.     

基于虚拟机的运行时入侵检测技术研究

入侵检测技术通常分为误用检测和异常检测两类,误用检测根据攻击模式库检测已知的攻击行为,但却难以防范未知的攻击行为;异常检测技术虽然可以预测偏离正常值阈区间的潜在攻击行为,但却存在较高的误报现象。在虚拟机监视器中对虚拟机操作系统的运行行为进行带外监控,避免了操作系统内监控模块被病毒感染的难题;通过监视虚拟机的运行时行为,对之作组合序列的合法性分析,扩展了误用检测防范长时间段攻击行为的能力,识别通过合法系统调用进行的恶意攻击。测试数据表明,该技术能够较好地检测出复杂组合攻击行为。     

基于粒子群和人工免疫的混合入侵检测系统研究

目前,漏报率和误报率高一直是入侵检测系统（IDS）的主要问题,而IDS主要有误用型和异常型两种检测技术。根据这两种检测技术各自的优点以及它们的互补性,本文给出一种基于人工免疫的异常检测技术和基于粒子群优化（PSO）的误用检测技术相结合的IDS模型;同时,该系统还结合特征选择技术降低数据维度,提高系统检测性能。实验表明,该
系统具有较高的检测率和较低的误报率,可以自动更新规则库,并且记忆未知类型的攻击,是一种有效的检测方法。     

Optimizing the Scalability of Network Intrusion Detection Systems Using Mobile Agents

Modern Intrusion Detection Systems (IDSs) are distributed real-time systems that detect unauthorized use or attacks upon an organization's network and/or hosts. The components of most distributed IDSs are arranged in a hierarchical tree structure, where the sensor nodes pass information to the analyzer nodes. Optimal placement of the analyzer nodes results in an improved response time for the IDS, and isolation of attacks within the IDS network. Since the network topology and workload are constantly changing, we are able to maintain near-optimal placement of the analyzer nodes by instantiating them as mobile agents. The analyzer nodes may then relocate, reproduce or be deleted as necessary. Such flexibility improves the response times and the stability of an IDS. The movement of the analyzer nodes also offers some protection against denial-of-service attacks, since secure analyzer nodes will be relocated to take over some of the functionality of the host under attack.     

一种基于移动Agent的抗攻击性IDS模型

随着入侵检测系统(Inhusion Detection System——IDS)性能的逐步提高，攻击者往往在入侵目标网络之前攻击IDS，使其丧失保护功能。在当前常用的分布式入侵检测系统的基础上，提出了一种能够对抗拒绝服务(Denial of Service——DoS)攻击的IDS模型，并指出了将当前的分布式IDS转换成此模型的配置方法。     

Measuring IDS-estimated attack impacts for rational incident response: A decision theoretic approach

Intrusion detection system (IDS) plays a vital role in defending our cyberspace against attacks. Either misuse-based IDS or anomaly-based IDS, or their combinations, however, can only partially reflect the true system state due to excessive false alerts, low detection rate, and inaccurate incident diagnosis. An automated response component built upon IDS therefore must consider the stale and imperfect picture inferred from them and takes action accordingly.This article presents an approach for measuring attack impact with the evidence of IDS alerts, with the objective to suggest rational response by cost-benefit analysis. More specifically, based on a very realistic assumption that a system evolves as a Markov decision process conditioned upon the current system state, imperfect observation, and action, we use partially observable Markov decision process to model the efficacy of IDS as providing a probabilistic assessment of the state of system assets, and to maximize a reward signal (defined as a function of both cost and benefit) by taking appropriate actions in response to the estimated system states in terms of desirable security properties. The ultimate goal is to move the system to more secure states with respect to pre-specified security metrics, and assist system administrators to identify the best tradeoff between the cost and benefit of security policies. We finally use a benchmark data set to practically illustrate the application of our methodology and conduct a proof-of-concept validation on its feasibility and efficiency.     

IDSIC: an intrusion detection system with identification capability

Security is an important but challenging issue in current network environments. With the growth of Internet, application systems in enterprises may suffer from new security threats caused by external intruders. This situation results in the introduction of security auditors (SAs) who perform some test methods with hacking tools the same as or similar to those used by hackers. However, current intrusion detection systems (IDSs) do not consider the role of security auditors despite its importance. This causes IDSs to generate many annoying alarms. In this paper, we are motivated to extend a current IDS functionality with Identification Capability, called IDSIC, based on the auditing viewpoint to separate auditing traffic from malicious attacks. The IDSIC architecture includes two components: fingerprint adder and fingerprint checker, which can provide a separability of security auditors and hackers. With this architecture, we show that IDSICs can lower the consequential costs in the current IDSs. Therefore, such IDSICs can ensure a more stable system performance during the security examination process.     

一种分布式入侵检测模型的设计

传统的基于异常的或基于误用的入侵检测总是在正常和非正常间作出一个绝对的选择，这种结果丢弃了大量有价值的信息，导致检测效果的不理想，尤其是在复杂的分布式网络环境中更加如此。针对此不足，文中提出基于模糊理论的模糊决策引擎(FDE)，它是分布式入侵检测系统中检测代理的一部分，能够在判定入侵行为时，基于模糊理论综合的考虑各种因素。带有FDE的分布式入侵检测系统的综合评估过程是一个层次结构，拥有分析来自于检测代理的各类信息的能力。这样的入侵检测系统拥有高精确的入侵检测、高效的决策过程以及系统资源消耗低的优点。     

A hybrid artificial immune system and Self Organising Map for network intrusion detection

Network intrusion detection is the problem of detecting unauthorised use of, or access to, computer systems over a network. Two broad approaches exist to tackle this problem: anomaly detection and misuse detection. An anomaly detection system is trained only on examples of normal connections, and thus has the potential to detect novel attacks. However, many anomaly detection systems simply report the anomalous activity, rather than analysing it further in order to report higher-level information that is of more use to a security officer. On the other hand, misuse detection systems recognise known attack patterns, thereby allowing them to provide more detailed information about an intrusion. However, such systems cannot detect novel attacks.A hybrid system is presented in this paper with the aim of combining the advantages of both approaches. Specifically, anomalous network connections are initially detected using an artificial immune system. Connections that are flagged as anomalous are then categorised using a Kohonen Self Organising Map, allowing higher-level information, in the form of cluster membership, to be extracted. Experimental results on the KDD 1999 Cup dataset show a low false positive rate and a detection and classification rate for Denial-of-Service and User-to-Root attacks that is higher than those in a sample of other works.     

Alert correlation in collaborative intelligent intrusion detection systems—A survey

As complete prevention of computer attacks is not possible, intrusion detection systems (IDSs) play a very important role in minimizing the damage caused by different computer attacks. There are two intrusion detection methods: namely misuse- and anomaly-based. A collaborative, intelligent intrusion detection system (CIIDS) is proposed to include both methods, since it is concluded from recent research that the performance of an individual detection engine is rarely satisfactory. In particular, two main challenges in current collaborative intrusion detection systems (CIDSs) research are highlighted and reviewed: CIDSs system architectures and alert correlation algorithms. Different CIDSs system, architectures are explained and compared. The use of CIDSs together with other multiple security systems raise certain issues and challenges in, alert correlation. Several different techniques for alert correlation are discussed. The focus will be on correlation of CIIDS alerts. Computational, Intelligence approaches, together with their applications on IDSs, are reviewed. Methods in soft computing collectively provide understandable, and autonomous solutions to IDS problems. At the end of the review, the paper suggests fuzzy logic, soft computing and other AI techniques, to be exploited to reduce the rate of false alarms while keeping the detection rate high. In conclusion, the paper highlights opportunities for an integrated solution to large-scale CIIDS.     

A neuro-genetic based short-term forecasting framework for network intrusion prediction system

Information systems are one of the most rapidly changing and vulnerable systems, where security is a major issue. The number of security-breaking attempts originating inside organizations is increasing steadily. Attacks made in this way, usually done by ＂authorized＂ users of the system, cannot be immediately traced. Because the idea of filtering the traffic at the entrance door, by using firewalls and the like, is not completely successful, the use of intrusion detection systems should be considered to increase the defense capacity of an information system. An intrusion detection system （IDS） is usually working in a dynamically changing environment, which forces continuous tuning of the intrusion detection model, in order to maintain sufficient performance. The manual tuning process required by current IDS depends on the system operators in working out the tuning solution and in integrating it into the detection model. Furthermore, an extensive effort is required to tackle the newly evolving attacks and a deep study is necessary to categorize it into the respective classes. To reduce this dependence, an automatically evolving anomaly IDS using neuro-genetic algorithm is presented. The proposed system automatically tunes the detection model on the fly according to the feedback provided by the system operator when false predictions are encountered. The system has been evaluated using the Knowledge Discovery in Databases Conference （KDD 2009） intrusion detection dataset. Genetic paradigm is employed to choose the predominant features, which reveal the occurrence of intrusions. The neuro-genetic IDS （NGIDS） involves calculation of weightage value for each of the categorical attributes so that data of uniform representation can be processed by the neuro-genetic algorithm. In this system unauthorized invasion of a user are identified and newer types of attacks are sensed and classified respectively by the neuro-genetic algorithm. The experimental results obtained in this work show that the system achieves improvement in terms of misclassification cost when compared with conventional IDS. The results of the experiments show that this system can be deployed based on a real network or database environment for effective prediction of both normal attacks and new attacks.     

A research using hybrid RBF/Elman neural networks for intrusion detection system secure model

A hybrid RBF/Elman neural network model that can be employed for both anomaly detection and misuse detection is presented in this paper. The IDSs using the hybrid neural network can detect temporally dispersed and collaborative attacks effectively because of its memory of past events. The RBF network is employed as a real-time pattern classification and the Elman network is employed to restore the memory of past events. The IDSs using the hybrid neural network are evaluated against the intrusion detection evaluation data sponsored by U.S. Defense Advanced Research Projects Agency (DARPA). Experimental results are presented in ROC curves. Experiments show that the IDSs using this hybrid neural network improve the detection rate and decrease the false positive rate effectively.     

模糊神经网络在入侵检测中的应用

目前绝大多数误用检测系统均不能检测已知攻击的变种 ,对未知攻击的检测也十分有限 ,而基于用户行为的异常检测系统对攻击检测的误报率太高 ,且不能发现攻击者通过慢慢改变其行为躲过检测的欺骗行为 .将模糊神经网络应用于入侵检测领域 ,并采用基于进程行为的检测方法 ,能有效的解决上述问题 ,较好地改进入侵检测系统的性能 ,降低漏报误报率 .     

入侵检测技术研究与系统设计

入侵检测技术是一种主动保护网络资源免受黑客攻击的安全技术。入侵检测系统监控受保护系统的使用情况,发现不安全状态。它不仅帮助系统对付外来网络攻击,还可以查知内部合法用户的非法操作,扩展了系统管理员的安全管理能力。入侵检测为系统提供了实时保护,被认为是防火墙之后的第二道安全闸门。文章讲述了入侵检测技术的发展状况和关键技术,对现有系统进行了分类,并指出了该技术面临的一些挑战。最后提出了一种基于数据挖掘技术的具有自学习、自完善功能的入侵检测模型,可发现已知和未知的滥用入侵和异常入侵活动。     

基于异常与误用的入侵检测系统

入侵检测系统近年来得到长足的发展,但功能都不够完善.为此将基于误用的入侵检测与基于异常的检测结合为一体.在误用检测上,将检测规则进行分类排序,从而极大地提高了检测效率.异常检测则采用人工免疫技术,使系统对已知的攻击和新型攻击均有较强检测能力.     

基于异常和特征的入侵检测系统模型

目前大多数入侵检测系统(Intrusion Detection System，IDS)没有兼备检测已知和未知入侵的能力，甚至不能检测已知入侵的微小变异，效率较低。本文提出了一种结合异常和特征检测技术的IDS。使用单一技术的IDS存在严重的缺点，为提高其效率，唯一的解决方案是两者的结合，即基于异常和特征的入侵检测。异常检测能发现未知入侵，而基于特征的检测能发现已知入侵，结合两者而成的基于异常和特征的入侵检测系统不但能检测已知和未知的入侵，而且能更新基于特征检测的数据库，因而具有很高的效率。     

Data preprocessing for anomaly based network intrusion detection: A review

Data preprocessing is widely recognized as an important stage in anomaly detection. This paper reviews the data preprocessing techniques used by anomaly-based network intrusion detection systems (NIDS), concentrating on which aspects of the network traffic are analyzed, and what feature construction and selection methods have been used. Motivation for the paper comes from the large impact data preprocessing has on the accuracy and capability of anomaly-based NIDS. The review finds that many NIDS limit their view of network traffic to the TCP/IP packet headers. Time-based statistics can be derived from these headers to detect network scans, network worm behavior, and denial of service attacks. A number of other NIDS perform deeper inspection of request packets to detect attacks against network services and network applications. More recent approaches analyze full service responses to detect attacks targeting clients. The review covers a wide range of NIDS, highlighting which classes of attack are detectable by each of these approaches.Data preprocessing is found to predominantly rely on expert domain knowledge for identifying the most relevant parts of network traffic and for constructing the initial candidate set of traffic features. On the other hand, automated methods have been widely used for feature extraction to reduce data dimensionality, and feature selection to find the most relevant subset of features from this candidate set. The review shows a trend toward deeper packet inspection to construct more relevant features through targeted content parsing. These context sensitive features are required to detect current attacks.     

一种混合式网络入侵检测系统

入侵检测系统通常采用单一的检测模式,难以有效地处理漏报和误报问题。该文分析不同类型网络流量的分布特征,提出一种将异常检测和误用检测相结合的混合式网络入侵检测系统,从总体上克服了单一模式的不足。实验结果表明,该方法能有效地提高入侵检测系统的检测率和准确率。     

基于本体的Web服务攻击检测技术研究

Web服务在给基于异构平台的应用集成带来极大便利的同时,各核心组件也面临着被恶意攻击的威胁。目前,主要依靠入侵检测系统(IDS)来检测这些攻击,但是分布在网络中的IDS往往是由不同的厂商或组织开发的,没有用于交换知识的可被共同理解的词汇集,难以交互和协作,工作效率低且很难抵御多层次、分布式攻击。提出了一种基于本体和Web本体标准语言（OWL）的Web服务攻击分类和描述方法,通过构建Web服务攻击本体以提供不同IDS共同理解的词汇集。在此基础上,设计了一种基于Web服务攻击本体库的入侵检测系统(O-IDS),能有效弥补现有IDS难以交互的不足,提高对多层次、分布式攻击的检测能力。