The objective of this paper is to construct a lightweight Intrusion Detection System (IDS) aimed at detecting anomalies in networks. The crucial part of building lightweight IDS depends on preprocessing of network data, identifying important features and in the design of efficient learning algorithm that classify normal and anomalous patterns. Therefore in this work, the design of IDS is investigated from these three perspectives. The goals of this paper are (i) removing redundant instances that causes the learning algorithm to be unbiased (ii) identifying suitable subset of features by employing a wrapper based feature selection algorithm (iii) realizing proposed IDS with neurotree to achieve better detection accuracy. The lightweight IDS has been developed by using a wrapper based feature selection algorithm that maximizes the specificity and sensitivity of the IDS as well as by employing a neural ensemble decision tree iterative procedure to evolve optimal features. An extensive experimental evaluation of the proposed approach with a family of six decision tree classifiers namely Decision Stump, C4.5, Naive Baye's Tree, Random Forest, Random Tree and Representative Tree model to perform the detection of anomalous network pattern has been introduced.

Decision tree based light weight intrusion detection using a wrapper approach

Rapid growth in the Internet usage and diverse military applications have led researchers to think of intelligent systems that can assist the users and applications in getting the services by delivering required quality of service in networks. Some kinds of intelligent techniques are appropriate for providing security in communication pertaining to distributed environments such as mobile computing, e-commerce, telecommunication, and network management. In this paper, a survey on intelligent techniques for feature selection and classification for intrusion detection in networks based on intelligent software agents, neural networks, genetic algorithms, neuro-genetic algorithms, fuzzy techniques, rough sets, and particle swarm intelligence has been proposed. These techniques have been useful for effectively identifying and preventing network intrusions in order to provide security to the Internet and to enhance the quality of service. In addition to the survey on existing intelligent techniques for intrusion detection systems, two new algorithms namely intelligent rule-based attribute selection algorithm for effective feature selection and intelligent rule-based enhanced multiclass support vector machine have been proposed in this paper.

/pdf/intelligent-feature-selection-and-classification-techniques-2y06fjzp6o.pdf

Intelligent feature selection and classification techniques for intrusion detection in networks: a survey

Fraud detection has been an important topic of research in the data mining community for the past two decades. Supervised, semi-supervised, and unsupervised approaches to fraud detection have been proposed for the telecommunications, credit, insurance and health-care industries. We describe a novel hybrid system for detecting fraud in the highly growing lotteries and online games of chance sector. While the objectives of fraudsters in this sector are not unique, money laundering and insider attack scenarios are much more prevalent in lotteries than in the previously studied sectors. The lack of labeled data for supervised classifier design, user anonymity, and the size of the data-sets are the other key factors differentiating the problem from previous studies, and are the key drivers behind the design and implementation decisions for the system described. The system employs online algorithms that optimally aggregate statistical information from raw data and applies a number of pre-specified checks against known fraud scenarios as well as novel clustering-based algorithms for outlier detection which are then fused together to produce alerts with high detection rates at acceptable false alarm levels.

Detecting fraud in online games of chance and lotteries

We present a classifier ensemble system using a combination of Neural Networks and rule-based systems as base classifiers that is capable of detecting network-initiated intrusion attacks on web servers. The system can recognize novel attacks (i.e., attacks it has never seen before) and categorize them as such. The performance of the Neural Network in detecting attacks from network data alone is very good with success rates of more than 78% in recognizing new attacks but suffers from high false alarms rates. An ensemble combining the original ANN with a second component that monitors the server's system calls for detecting unusual activity results in high prediction accuracy with very small false alarm rates. We experiment with a variety of ensemble classifiers and decision making schemes for final classification. We report on the results we got from our approach and future directions for this research

A Classifier Ensemble Approach to Intrusion Detection for Network-Initiated Attacks

Intrusion Detection Systems (IDS) are a very popular network security tool These tools can allow network administrators, to identify and react to hostile traffic aimed at, or generated from their own network In general there are two common Intrusion Detection approaches which are behavior or traffic anomaly based and knowledge or signature based As a result of the increased sophistication of intrusion attacks, one very desirable feature of advanced IDS is to be capable of learning and generalizing from known traffic patterns of a system, process or a user’s behavior In this project we investigated the use of a novel Artificial Intelligence (AI) approach to intrusion detection based on network traffic anomaly detection The AI technique used is based on the Hierarchical Temporal Memory (HTM) paradigm developed by Numenta, which is a relatively new AI concept that mimics the operation of the neocortex area of the human brain[11,14] The developed AI scheme was evaluated using the corpus of data from Massachusetts Institute of Technology, Lincoln Laboratories in USA [20] Our results show that HTM based intrusion detection can achieve relatively high success rates in identifying anomalous traffic in computer networks, furthermore our research also shows that HTM based schemes can achieve very fast detection rates making them a very good alternative for real time intrusion detection engine

Detecting Network Intrusions Using Hierarchical Temporal Memory

We present a hybrid system based on a combination of Neural Networks and rule-based matching systems that is capable of detecting network-initiated intrusion attacks on web servers. The system has a strong learning component allowing it to recognize even novel attacks (i.e. attacks it has never seen before) and categorize them as such. The performance of the Neural Network in detecting attacks is very good with success rates of more than 78% in recognizing new attacks. However, because of an alarmingly high false alarm rate that measures more than 90% on normal HTTP traffic carrying image uploads we had to combine the original ANN with a rule-based component that monitors the server’s system calls for detecting unusual activity. A final component combines the two systems to make the final decision on whether to raise an intrusion alarm or not. We report on the results we got from our approach and future directions for this research.

/pdf/an-intrusion-detection-system-for-network-initiated-attacks-2vgbz9nyhw.pdf

Stefanos Koutsoutos

Papers

A Classifier Ensemble Approach to Intrusion Detection for Network-Initiated Attacks

An Intrusion Detection System for Network-Initiated Attacks Using a Hybrid Neural Network