An adaptive automatically tuning intrusion detection system

Abstract

An intrusion detection system (IDS) is a security layer to detect ongoing intrusive activities in computer systems and networks. Current IDS have two main problems: The first problem is that typically so many alarms are generated as to overwhelm the system operator, many of these being false alarms. The second problem is that continuous tuning of the intrusion detection model is required in order to maintain sufficient performance due to the dynamically changing nature of the monitored system. This manual tuning process relies on the system operators to work out the updated tuning solution and to integrate it into the detection model.In this article, we present an automatically tuning intrusion detection system, which controls the number of alarms output to the system operator and tunes the detection model on the fly according to feedback provided by the system operator when false predictions are identified. This system adapts its behavior (i) by throttling the volume of alarms output to the operator in response to the ability of the operator to respond to these alarms, and (ii) by deciding how aggressively the detection model should be tuned based on the accuracy of earlier predictions. We evaluated our system using the KDDCup'99 intrusion detection dataset. Our results show that an adaptive, automatically tuning intrustion detection system will be both practical and efficient.

A three-stage analysis of IDS for critical infrastructures

“…These mechanisms are the IDSs [2], a security layer (HW or SW), designed to detect ongoing intrusive activities in computer systems and networks [28]. In the context of CCSs, IDSs are designed to monitor network or system activities for suspicious activities and produce reports to a management station.…”

Autonomic intrusion detection: Adaptively detecting anomalies over unlabeled audit data streams in computer networks

“…Yu et al [38] proposed an adaptive tuning IDS that can be tuned based on the detection performance. The detection model is represented by sets of rules and tuning amounts to adjusting confidence values associated with each rule.…”

Intrusion Detection System Inside Grid Computing Environment (IDS-IGCE)

“…Intrusion Detection Systems [16] have a very important role in the Grid Security Management. For the execution of large scale application or in service grid there is clearly need to detect the known or unknown intrusion and any other kind of dangerous events.…”