With the growth of the Internet and its potential, more and more people are getting connected to the Internet every day to take advantage of the e-Commerce. On one side, the Internet brings in tremendous potential to business in terms of reaching the end users. At the same time it also brings in lot of security risk to the business over the network. With the growth of cyber-attacks, information safety has become an important issue all over the world. Intrusion detection systems (IDSs) are an essential element for network security infrastructure and play a very important role in detecting large number of attacks. This survey paper introduces a detailed analysis of the network security problems and also represents a review of the current research. The main aim of the paper is to finds out the problem associated with network security for that various existing approaches related to intrusion detection and preventions are discussed. This survey focuses on presenting the different issues that must be addressed to build fully functional and practically usable intrusion detection systems (IDSs). It points out the state of the art in each area and suggests important open research issues.

/pdf/a-survey-on-secure-network-intrusion-detection-prevention-uo4bxcuefg.pdf

A Survey on Secure Network: Intrusion Detection & Prevention Approaches

With the growing use of information technology in all life domains, hacking has become more negatively effective than ever before. Also with developing technologies, attacks numbers are growing exponentially every few months and become more sophisticated so that traditional IDS becomes inefficient detecting them. This paper proposes a solution to detect not only new threats with higher detection rate and lower false positive than already used IDS, but also it could detect collective and contextual security attacks. We achieve those results by using Networking Chatbot, a deep recurrent neural network: Long Short Term Memory (LSTM) on top of Apache Spark Framework that has an input of flow traffic and traffic aggregation and the output is a language of two words, normal or abnormal. We propose merging the concepts of language processing, contextual analysis, distributed deep learning, big data, anomaly detection of flow analysis. We propose a model that describes the network abstract normal behavior from a sequence of millions of packets within their context and analyzes them in near real-time to detect point, collective and contextual anomalies. Experiments are done on MAWI dataset, and it shows better detection rate not only than signature IDS, but also better than traditional anomaly IDS. The experiment shows lower false positive, higher detection rate and better point anomalies detection. As for prove of contextual and collective anomalies detection, we discuss our claim and the reason behind our hypothesis. But the experiment is done on random small subsets of the dataset because of hardware limitations, so we share experiment and our future vision thoughts as we wish that full prove will be done in future by other interested researchers who have better hardware infrastructure than ours.

/pdf/big-data-analysis-and-distributed-deep-learning-for-next-abqnor1fsh.pdf

Big data analysis and distributed deep learning for next-generation intrusion detection system optimization

Anomaly-based Intrusion Detection System (IDS) has been a hot research topic because of its ability to detect new threats rather than only memorized signatures threats of signature-based IDS. Especially after the availability of advanced technologies that increase the number of hacking tools and increase the risk impact of an attack. The problem of any anomaly-based model is its high false-positive rate. The high false-positive rate is the reason why anomaly IDS is not commonly applied in practice. Because anomaly-based models classify an unseen pattern as a threat where it may be normal but not included in the training dataset. This type of problem is called overfitting where the model is not able to generalize. Optimizing Anomaly-based models by having a big training dataset that includes all possible normal cases may be an optimal solution but could not be applied in practice. Although we can increase the number of training samples to include much more normal cases, still we need a model that has more ability to generalize. In this research paper, we propose applying deep model instead of traditional models because it has more ability to generalize. Thus, we will obtain less false-positive by using big data and deep model. We made a comparison between machine learning and deep learning algorithms in the optimization of anomaly-based IDS by decreasing the false-positive rate. We did an experiment on the NSL-KDD benchmark and compared our results with one of the best used classifiers in traditional learning in IDS optimization. The experiment shows 10% lower false-positive by using deep learning instead of traditional learning.

/pdf/anomaly-detection-optimization-using-big-data-and-deep-4h1twq6izn.pdf

Anomaly detection optimization using big data and deep learning to reduce false-positive

The basic task in intrusion detection system is to classify network activities as normal or abnormal while minimizing misclassification In literature, various machine learning and data mining techniques have been applied to Intrusion Detection Systems (IDSs) to protect the special computer systems, vulnerable traffics cyber-attacks for computer networks In addition, Support Vector Machine (SVM) is applied as the classification techniques in literature However, there is a lack of review for the IDS method using SVM as the classifier The objective of this paper is to review the contemporary literature and to provide a critical evaluation of various techniques of intrusion detection using SVM as classifier We analyze and identify the strengths and limitations of various SVM usages as classifier in IDS systems This paper also highlights the usefulness of SVM in IDS system for network security environment with future direction

/pdf/evaluating-performance-of-intrusion-detection-system-using-389bfl4mti.pdf

Evaluating Performance of Intrusion Detection System using Support Vector Machines: Review

Air pollution is an olfactory pollution because many polluting gases have a strong odor even at low concentrations. These pollutants are natural or anthropogenic emission sources. This pollution has many harmful effects on human health or upon the environment. So it is necessary to detect the pollution to reduce its effects. An electronic nose is capable of detecting the presence of gas after learning. The artificial nose consists of an array of chemical sensors and an electronic system capable of recognizing patterns odors simple and complex. The performance of a sensor network is discussed by using pattern recognition methods. These methods can be supervised methods or unsupervised. Support Vector Machines SVMs is a supervised learning algorithm. In this article, we tested SVM based on kernel functions to evaluate the ability of our sensor array to distinguish between different groups of gases.

Gases identification with Support Vector Machines technique (SVMs)

This paper presents a novel network intrusion detection approach with the Support Vector Machine embedded in and Kfold cross-validation method compounded for optimizing the attributes and SVM model. Compared with some representative machine learning method, online data experimental results show that this method can be used to reduce the rate of FalseNegatives in the intrusion detection system.

/pdf/analysis-about-performance-of-multiclass-svm-applying-in-ids-3d4sqdi2yq.pdf

Jianhao Song

Papers

Analysis about Performance of Multiclass SVM Applying in IDS