A new two‐tiered strategy to intrusion detection

Abstract

Researchers have used many techniques in designing intrusion detection systems (IDS) and yet we still do not have an effective IDS. The interest in this work is to combine techniques of data mining and expert systems in designing an effective anomaly-based IDS. Combining methods may give better coverage, and make the detection more effective. The idea is to mine system audit data for consistent and useful patterns of user behaviour, and then keep these normal behaviours in profiles. An expert system is used as the detection system that recognizes anomalies and raises an alarm. The evaluation of the intrusion detection system design was carried out to justify the importance of the work.

Towards Building Secure Software Systems

“…The three security goals of computer system are Confidentiality, Integrity and Availability. These goals are commonly referred as the CIA of computer security (Sodiya, Longe, & Akinwale, 2004) and these goals also apply to computer systems.…”

An Expert System-Based Site Security Officer

“…Intrusion detection systems (IDSs) are security tools that are used to detect traces of malicious activities which are targeted against networks and their resources (Toth and Kruegel, 2002). According to Sodiya et al (2004), intrusion detection systems are systems that detect internal and external attack on computer systems and undertake some measures to eliminate them. An Intrusion Detection System (IDS) does not only helps the administrators to detect intrusions and limit damages, but also helps to identify the source of attacks, which sometimes acts as a deterrent, especially in case of insider attacks (Wang et al, 2006).…”

Towards Building Secure Software Systems

“…These goals are commonly referred as the CIA of computer security (Sodiya, Longe, & Akinwale, 2004) and these goals also apply to computer systems.…”