Embedded Markov process based model for performance analysis of Intrusion Detection and Prevention Systems

Alsubhi, Khalid; Zhani, Mohamed Faten; Boutaba, Raouf

doi:10.1109/glocom.2012.6503227

Cited by 5 publications

(3 citation statements)

References 22 publications

(21 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moreover, many other metrics can be inferred based on its context. Let ν represent the average firewall throughput, defined as the average number of packets leaving the firewall system [3]. Hence, given the sequential nature of the service stages, a packet does leave the system once it reach the first processing stage, as shown below.…”

Section: B Performance Modelingmentioning

confidence: 99%

A network challenge identification strategy based on firewall performance analysis

Ocampo

Gaviria

2013

2013 47th International Carnahan Conference on Security Technology (ICCST)

View full text Add to dashboard Cite

In this papper, we study a resource starvation challenge caused by low rate DoS (Denial of Service)-DDoS (Distributed DoS) attacks targeting the last-matching rules of the firewall's security policy. Our onset challenge detection mechanisms considers a CPU utilization threshold to keep track of firewall processing performance. In this way, when this threshold is reached, an initial alarm of the occurrence of an attack is triggered. Such a methodology enable to deploy an strategy of impact mitigation. Initial remediation actions against challenges are then considered once the detection part is performed, it includes the temporary swap of the most likely last-rule matched, in order to improve the system performance. We evaluate our strategy through simulations performed in Network Simulator 2, results show the performance of this scheme when subjected to normal traffic flows as well as DoS and DDoS attack flows.

show abstract

Section: B Performance Modelingmentioning

confidence: 99%

A network challenge identification strategy based on firewall performance analysis

Ocampo

Gaviria

2013

2013 47th International Carnahan Conference on Security Technology (ICCST)

View full text Add to dashboard Cite

show abstract

“…The study by [32] proposes an analytical queuing model for assessing the impact of IDPS performance on network QoS. It explores the trade-off between security and QoS, demonstrating how enhancing security can lead to improved performance, albeit with some trade-offs.…”

Section: Introductionmentioning

confidence: 99%

Strengthening Network Security: Evaluation of Intrusion Detection and Prevention Systems Tools in Networking Systems

Prabowo,

Fauziah,

Nahrowi

et al. 2023

IJACSA

View full text Add to dashboard Cite

This study aims to enhance network security by comprehensively evaluating various Intrusion Detection and Prevention Systems tools in networking systems. The objectives of this research were to assess the performance of different IDPS tools in terms of computer resources utilization, Quality of Service metrics namely delay, jitter, throughput, and packet loss, and their effectiveness in countering Distributed Denial of Service attacks, specifically ICMP Flood and SYN Flood. The evaluation used popular IDPS tools, including Snort, Suricata, Zeek, OSSEC, and Honeypot Cowrie. Real attack scenarios were simulated to measure the tools performance. The results indicated CPU and RAM usage variations among the tools, with Snort and Suricata showing efficient resource utilization. Regarding QoS metrics, Snort demonstrated superior performance in delay, jitter, throughput, and packet loss mitigation for both attack types. The implication for further research lies in exploring the optimal configurations and finetuning of IDPS tools to achieve the best possible network security against DDoS attacks. This research provides valuable insights into selecting appropriate IDPS tools for network administrators, cybersecurity professionals, and organizations to fortify their infrastructure against evolving cyber threats.

show abstract

“…Alsubhi et al [7] mentioned intrusion detection and/or prevention systems (IDPSs) as crucial defensive mechanism to get rid of the attacks by the intruders or hackers. Their study reveals that the IDPS configuration may impact the network performance adversely in terms of end-to-end delay and packet loss.…”

Section: Related Workmentioning

confidence: 99%

Adaptive Hybrid Model for Network Intrusion Detection and Comparison among Machine Learning Algorithms

Haque¹,

Al-Kharobi²

2015

IJMLC

View full text Add to dashboard Cite

Abstract-In this paper, we propose a novel method using ensemble learning scheme for classifying network intrusion detection from the most renowned KDD cup dataset. We have shown that reducing the dimensionality of the large dataset provides most accurate detection. Additionally, several machine learning algorithms are used to generate the accuracy metrics and analyzed further for proper comparison. Our approach found out that this algorithm outperforms all other learning techniques. Our goal is to analyze the network intrusion data and find out the best components and use them for the attack analysis. This scheme can be used in parallel with the intrusion detection system to augment its prediction performance for the future data packets. Empirical results show that the input dimensionality reduction can provide lightweight intrusion detection system that can be embedded with the vulnerable system for generating correct classification with significance improvement in execution time.

show abstract

Embedded Markov process based model for performance analysis of Intrusion Detection and Prevention Systems

Cited by 5 publications

References 22 publications

A network challenge identification strategy based on firewall performance analysis

A network challenge identification strategy based on firewall performance analysis

Strengthening Network Security: Evaluation of Intrusion Detection and Prevention Systems Tools in Networking Systems

Adaptive Hybrid Model for Network Intrusion Detection and Comparison among Machine Learning Algorithms

Contact Info

Product

Resources

About