Hybrid Fuzzy Adaptive Wiener Filtering with Optimization for Intrusion Detection

Intrusion detection plays a key role in detecting attacks over networks, and due to the increasing usage of Internet services, several security threats arise. Though an intrusion detection system (IDS) detects attacks efficiently, it also generates a large number of false alerts, which makes it difficult for a system administrator to identify attacks. This paper proposes automatic fuzzy rule generation combined with a Wiener filter to identify attacks. Further, to optimize the results, simplified swarm optimization is used. After training a large dataset, various fuzzy rules are generated automatically for testing, and a Wiener filter is used to filter out attacks that act as noisy data, which improves the accuracy of the detection. By combining automatic fuzzy rule generation with a Wiener filter, an IDS can handle intrusion detection more efficiently. Experimental results, which are based on collected live network data, are discussed and show that the proposed method provides a competitively high detection rate and a reduced false alarm rate in comparison with other existing machine learning techniques.     

基于Snort的混合入侵检测系统的研究与实现

在分析研究Snort系统的优缺点的基础上,利用其开源性和支持插件的优势,针对其对无法检测到新出现的入侵行为、漏报率较高以及检测速度较低等问题,在Snort系统的基础上结合入侵检测中的数据挖掘技术,提出一种基于Snort系统的混合入侵检测系统模型。该系统模型在Snort系统原有系统模型基础上增加了正常行为模式构建模块、异常检测模块、分类器模块、规则动态生成模块等扩展功能模块。改进后的混合入侵检测系统能够实时更新系统的检测规则库,进而检测到新的入侵攻击行为;同时,改进后的混合入侵检测系统具有误用检测和异常检测的功能,从而提高检测系统检测效率。     

Novel intrusion prediction mechanism based on honeypot log similarity

The current network‐based intrusion detection systems have a very high rate of false alarms, and this phenomena results in significant efforts to gauge the threat level of the anomalous traffic. In this paper, we propose an intrusion detection mechanism based on honeypot log similarity analysis and data mining techniques to predict and block suspicious flows before attacks occur. With honeypot logs and association rule mining, our approach can reduce the false alarm problem of intrusion detection because only suspicious traffic would be present in the honeypots. The proposed mechanism can reduce human effort, and the entire system can operate automatically. The results of our experiments indicate that the honeypot prediction system is practical for protecting assets from attacks or misuse.     

基于多层检测的网络安全防范系统

提出了一种基于多层的网络安全防范系统,该系统采用多层检测技术：在IP层采用基于聚集的拥塞控制算法（ABCC）,通过限制拥塞信号的宽度,使间接损害达到最小;然后在TCP和UPD层采用基于人体免疫原理的检测技术AIPT,通过建立规则集,将来自网络访问活动与规则集中的规则匹配,以检测出网络入侵行为。仿真实验结果表明,基于本模型的系统不仅能合理地缓解DoS/DDoS攻击,而且能够解决现有的防范系统中高误报率和漏报率以及实时性差、人工干预多的问题。     

Network Intrusion Detection Using a Stochastic Resonance CFAR Technique

A novel constant false alarm rate (CFAR) intrusion detection method based on stochastic resonance (SR) is proposed in this paper. Using the SR technique improves the spectral power (SP) and the signal-to-noise ratio (SNR) of the network intrusion signal, hence enhancing the detectability of network attacks. The threshold and the detection probability of the proposed SR-CFAR method are derived theoretically. Computer simulations based on standard Defense Advanced Research Projects Agency (DARPA) network intrusion data show that this CFAR method outperforms the linear anomaly intrusion detection methods for various types of intrusions.     

A new ontology‐based multi agent framework for intrusion detection

Ontologies play an essential role in knowledge sharing and exploration, especially in multiagent systems. Intrusion is an unauthorized activity in a network, which is achieved by either active manner (information gathering) or passive manner (harmful packet forwarding). Most of the existing intrusion detection system (IDS) suffers from the following issues: it is usually adjusted to detect known service level network attacks and leaves from vulnerable to original and novel malicious attacks. Thus, it provides low accuracy and detection rate, which are the important problems of existing IDS. To overwhelm these drawbacks, an ontology‐based multiagent IDS framework is developed in this work for intrusion detection. The main intention of this work is to detect the network attacks with the help of multiple detection agents. In this analysis, there are 3 different types of agents, ie, IDS broker, deputy commander, and response agent, which are used to prevent and detect the attacks in a network. The novel concept of this work is based on the concept of signature matching; it identifies and detects the attackers with the help of multiple agents.     

Effective allied network security system based on designed scheme with conditional legitimate probability against distributed network attacks and intrusions

Dependence on the Internet is increasing dramatically. Therefore, many researchers have given great attention to the issue of how to tighten Internet security. This study proposes a new scheme for the distributed intrusion prevention system (DIPS), in which the concept of ‘union’ is presented for satisfying the increasing requirements of Internet security issues. In this proposed design, the network intrusion detection system (NIDS) applies a misuse detection technique to detect well‐known intrusion behavior on the Internet. Meanwhile, for anomaly detection technique, a tool named ‘Scent’ (a network traffic sniffer) is combined with conditional legitimate probability to reveal previously undiscovered intrusion packets that do not match the intrusion signatures in NIDS. Moreover, blocking distributed denial‐of‐service (DDoS) attacks inside the protected allied network is also covered. To increase the detection accuracy, reduction of false positives and false negatives is also accomplished. Experimental results reveal that the suggested network security system scheme is effective and efficient in resolving the intrusion activity problem of real network environments. Copyright © 2011 John Wiley & Sons, Ltd.     

Protection of MANETs from a range of attacks using an intrusion detection and prevention system

Mobile ad hoc networks (MANETs) are well known to be vulnerable to various attacks due to their lack of centralized control, and their dynamic topology and energy-constrained operation. Much research in securing MANETs has focused on proposals which detect and prevent a specific kind of attack such as sleep deprivation, black hole, grey hole, rushing or sybil attacks. In this paper we propose a generalized intrusion detection and prevention mechanism. We use a combination of anomaly-based and knowledge-based intrusion detection to secure MANETs from a wide variety of attacks. This approach also has the capability to detect new unforeseen attacks. Simulation results of a case study shows that our proposed mechanism can successfully detect attacks, including multiple simultaneous different attacks, and identify and isolate the intruders causing a variety of attacks, with an affordable network overhead. We also investigate the impact on the MANET performance of (a) the various attacks and (b) the type of intrusion response, and we demonstrate the need for an adaptive intrusion response.     

基于FSM检测的移动自组网攻击分类研究

在移动自组网环境下,由于移动节点可能被攻击截获,导致攻击从内部产生,传统的网络安全措施难以应用,只有通过入侵检测才能发现攻击者。通过分析移动自组网的攻击类型,并构造从恶意节点发起的攻击树,采用有限状态机的思想,设计一个基于FSM的入侵检测算法。采用该算法的入侵检测系统可通过邻居节点的监视,实时地检测到节点的各种攻击行为。     

无线传感器网络入侵检测系统

无线传感器网络与传统网络存在较大差异,传统入侵检测技术不能有效地应用于无线传感器网络。文中分析了无线传感器网络面临的安全威胁;总结了现有的无线传感器网络入侵检测方案;在综合现有无线传感器网络入侵检测方法的基础上,提出了一种分等级的入侵检测系统,该入侵检测体系结构通过减少错报能检测到大多数的安全威胁。     

基于克隆选择聚类的入侵检测

提出基于克隆选择的模糊聚类算法，将该聚类算法用于网络入侵检测。针对入侵数据的混合属性改进距离测度的计算方法，实现了对大规模混合属性原始数据的异常检测，并能有效检测到未知攻击。在KDDCUP99数据集中进行了对比仿真实验，实验结果表明算法对已知攻击和未知攻击的检测率以及算法的误誊率都是理想的。     

低层网络攻击及检测方法

常规的探作系统因缺乏充足的审计教据使基于主机的入侵检测系统无法检测到低层网络攻击。基于网络的入侵检测系统因只依靠网上教据流而不能检测到所有攻击。本文分析了几种低层IP攻击，在分析的基础上，提出在探作系统的审计记录中添加部分审计教据，使基于主机的入侵检测系统能检测到低层网络攻击。     

Towards trustworthy collaboration in spectrum sensing for ad hoc cognitive radio networks

Cognitive radio networks (CRN) make use of dynamic spectrum access to communicate opportunistically in frequency bands otherwise licensed to incumbent primary users such as TV broadcast. To prevent interference to primary users it is vital for secondary users in CRNs to conduct accurate spectrum sensing, which is especially challenging when the transmission range of primary users is shorter compared to the size of the CRN. This task becomes even more challenging in the presence of malicious secondary users that launch spectrum sensing data falsification (SSDF) attacks by providing false spectrum reports. Existing solutions to detect such malicious behaviors cannot be utilized in scenarios where the transmission range of primary users is limited within a small sub-region of the CRN. In this paper, we present a framework for trustworthy collaboration in spectrum sensing for ad hoc CRNs. This framework incorporates a semi-supervised spatio-spectral anomaly/outlier detection system and a reputation system, both designed to detect byzantine attacks in the form of SSDF from malicious nodes within the CRN. The framework guarantees protection of incumbent primary users’ communication rights while at the same time making optimal use of the spectrum when it is not used by primary users. Simulation carried out under typical network conditions and attack scenarios shows that our proposed framework can achieve spectrum decision accuracy up to 99.3 % and detect malicious nodes up to 98 % of the time.     

基于Octeon多核网络处理器的IPv6联动IPS研究与设计

对基于Octeon多核网络处理器的新一代IPv6高速网络联动入侵防御系统进行研究,设计了新型联动入侵防御原型.系统基于Octeon多核的高速处理,并结合了IPv6网络中入侵的新特点.在基于入侵检测规则库规则匹配技术的基础上,运用新型的协议分析技术和基于流的检测技术,在Octeon多核间分配控制层与数据层的不同执行,采用命名块机制进行多核间通信,通过数据层核向控制层核的反馈,实现了流处理及协议分析模块与控制模块的高速联动.系统实现了Gbps级的高速入侵检测与联动防御处理.     

Optimized deep learning-based intrusion detection for wireless sensor networks

The technological innovations and wide use of Wireless Sensor Network (WSN) applications need to handle diverse data. These huge data possess network security issues as intrusions that cannot be neglected or ignored. An effective strategy to counteract security issues in WSN can be achieved through the Intrusion Detection System (IDS). IDS ensures network integrity, availability, and confidentiality by detecting different attacks. Regardless of efforts by various researchers, the domain is still open to obtain an IDS with improved detection accuracy with minimum false alarms to detect intrusions. Machine learning models are deployed as IDS, but their potential solutions need to be improved in terms of detection accuracy. The neural network performance depends on feature selection, and hence, it is essential to bring an efficient feature selection model for better performance. An optimized deep learning model has been presented to detect different types of attacks in WSN. Instead of the conventional parameter selection procedure for Convolutional Neural Network (CNN) architecture, a nature-inspired whale optimization algorithm is included to optimize the CNN parameters such as kernel size, feature map count, padding, and pooling type. These optimized features greatly improved the intrusion detection accuracy compared to Deep Neural network (DNN), Random Forest (RF), and Decision Tree (DT) models.     

On Scalable Attack Detection in the Network

Current intrusion detection and prevention systems seek to detect a wide class of network intrusions (e.g., DoS attacks, worms, port scans) at network vantage points. Unfortunately, even today, many IDS systems we know of keep per-connection or per-flow state to detect malicious TCP flows. Thus, it is hardly surprising that these IDS systems have not scaled to multi-gigabit speeds. By contrast, both router lookups and fair queuing have scaled to high speeds using aggregation via prefix lookups or DiffServ. Thus, in this paper, we initiate research into the question as to whether one can detect attacks without keeping per-flow state. We will show that such aggregation, while making fast implementations possible, immediately causes two problems. First, aggregation can cause behavioral aliasing where, for example, good behaviors can aggregate to look like bad behaviors. Second, aggregated schemes are susceptible to spoofing by which the intruder sends attacks that have appropriate aggregate behavior. We examine a wide variety of DoS and scanning attacks and show that several categories (bandwidth based, claim-and-hold, port-scanning) can be scalably detected. In addition to existing approaches for scalable attack detection, we propose a novel data structure called partial completion filters (PCFs) that can detect claim-and-hold attacks scalably in the network. We analyze PCFs both analytically and using experiments on real network traces to demonstrate how we can tune PCFs to achieve extremely low false positive and false negative probabilities     

Biologically inspired artificial intrusion detection system for detecting wormhole attack in MANET

A mobile ad hoc network (MANET) does not have traffic concentration points such as gateway or access points which perform behaviour monitoring of individual nodes. Therefore, maintaining the network function for the normal nodes when other nodes do not forward and route properly is a big challenge. One of the significant attacks in ad hoc network is wormhole attack. In this wormhole attack, the adversary disrupts ad hoc routing protocols using higher bandwidth and lower-latency links. Wormhole attack is more hidden in character and tougher to detect. So, it is necessary to use mechanisms to avoid attacking nodes which can disclose communication among unauthorized nodes in ad hoc networks. Mechanisms to detect and punish such attacking nodes are the only solution to solve this problem. Those mechanisms are known as intrusion detection systems (IDS). In this paper, the suggested biological based artificial intrusion detection system (BAIDS) include hybrid negative selection algorithm (HNSA) detectors in the local and broad detection subsection to detect anomalies in ad hoc network. In addition to that, response will be issued to take action over the misbehaving nodes. These detectors employed in BAIDS are capable of discriminating well behaving nodes from attacking nodes with a good level of accuracy in a MANET environment. The performance of BAIDS in detecting wormhole attacks in the background of DSR, AODV and DSDV routing protocols is also evaluated using Qualnet v 5.2 network simulator. Detection rate, false alarm rate, packet delivery ratio, routing overhead are used as metrics to compare the performance of HNSA and the BAIDS technique.     

A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods

Large-scale computer network attacks in their final stages can readily be identified by observing very abrupt changes in the network traffic. In the early stage of an attack, however, these changes are hard to detect and difficult to distinguish from usual traffic fluctuations. Rapid response, a minimal false-alarm rate, and the capability to detect a wide spectrum of attacks are the crucial features of intrusion detection systems. In this paper, we develop efficient adaptive sequential and batch-sequential methods for an early detection of attacks that lead to changes in network traffic, such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. These methods employ a statistical analysis of data from multiple layers of the network protocol to detect very subtle traffic changes. The algorithms are based on change-point detection theory and utilize a thresholding of test statistics to achieve a fixed rate of false alarms while allowing us to detect changes in statistical models as soon as possible. There are three attractive features of the proposed approach. First, the developed algorithms are self-learning, which enables them to adapt to various network loads and usage patterns. Secondly, they allow for the detection of attacks with a small average delay for a given false-alarm rate. Thirdly, they are computationally simple and thus can be implemented online. Theoretical frameworks for detection procedures are presented. We also give the results of the experimental study with the use of a network simulator testbed as well as real-life testing for TCP SYN flooding attacks.     

基于免疫机理的自适应Agent在网络入侵检测系统中的应用

传统的入侵检测系统主要采用的是异常检测和误用检测的方法，误报率和漏报率较高，自适应性较差．难以满足当前的网络安全需求。文章针对当前入侵检测系统存在的这些问题提出了一种基于免疫机理的．利用自适应Agent技术实现的入侵检测系统模型，该系统采用了三种Agent．一种是预警Agent．它们通过监听流量发现异常，发出入侵预警警报；一种是评估Agent，它们通过收集各个Agent对于当前事件的预测建议得出是否是入侵的结论；管理Agent处于系统的最高层，在进行系统训练时发挥作用，判定评估Agent的结论是否正确．并给出反馈意见，评估Agent根据管理Agent的反馈意见对预警Agent的权值进行修正．该系统结合了异常检测和误用检测的优点，具备在线升级自身的抗体权值的能力．从而提高了系统抵御攻击的能力和自适应性。     

基于入侵监测的网络信息安全管理技术

针对网络安全面临非法入侵威胁、实时防御性差的问题,文中研究和分析了基于入侵监测的网络信息安全管理技术。通过在现有网络模型中增加入侵监测模块,将网络信息采集、信息处理和信息分析3个模块相结合进行入侵监测。为提升入侵监测的准确率,利用基于数据降维的决策树方法对异常数据进行识别,有效实现不同类型的异常数据监测。系统验证表明,所提出的入侵监测方法对于不同类型的入侵均有较好的监测效果,比现有算法提高了约8%。