Intrusion Detection: A Survey

Sabahi, Farnaz; Movaghar, Ali

doi:10.1109/icsnc.2008.44

Cited by 145 publications

(71 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This classification defines families of intrusion detection systems according to their properties. There are four different types (Figure 1) of intrusion detection available based on the past (Axelsson, 1998;Richard and Giovanni, 2002) and current researches (Scarfone and Peter, 2007;Sabahi and Movaghar, 2008). The following paragraphs explain the types in detail.…”

Section: Need For Hybrid Ids Systemsmentioning

confidence: 99%

Hybrid Intrusion Detection Systems (HIDS) using Fuzzy Logic

Shanmugam¹,

Idris²

2011

Intrusion Detection Systems

View full text Add to dashboard Cite

Section: Need For Hybrid Ids Systemsmentioning

confidence: 99%

Hybrid Intrusion Detection Systems (HIDS) using Fuzzy Logic

Shanmugam¹,

Idris²

2011

Intrusion Detection Systems

View full text Add to dashboard Cite

“…A detailed overview of the different detection techniques, characteristics, and methods of IDSs has been given by [29], and the focus of this work is in those IDSs that practice misuse detection on the network. As already mentioned, machine learning has been already used in other security studies as [16] and [17] on botnets or [2] [18] [19] [26] on different DNS issues.…”

Section: Related Workmentioning

confidence: 99%

What's Your Major Threat? On the Differences between the Network Behavior of Targeted and Commodity Malware

Mariconti

Onaolapo

Ross

et al. 2016

2016 11th International Conference on Availability, Reliability and Security (ARES)

View full text Add to dashboard Cite

Abstract-This work uses statistical classification techniques to learn about the different network behavior patterns demonstrated by targeted malware and generic malware. Targeted malware is a recent type of threat, involving bespoke software that has been created to target a specific victim. It is considered a more dangerous threat than generic malware, because a targeted attack can cause more serious damage to the victim. Our work aims to automatically distinguish between the network activity generated by the two types of malware, which then allows samples of malware to be classified as being either targeted or generic. For a network administrator, such knowledge can be important because it assists to understand which threats require particular attention. Because a network administrator usually manages more than an alarm simultaneously, the aim of the work is particularly relevant. We set up a sandbox and infected virtual machines with malware, recording all resulting malware activity on the network. Using the network packets produced by the malware samples, we extract features to classify their behavior. Before performing classification, we carefully analyze the features and the dataset to study all their details and gain a deeper understanding of the malware under study. Our use of statistical classifiers is shown to give excellent results in some cases, where we achieved an accuracy of almost 96% in distinguishing between the two types of malware. We can conclude that the network behaviors of the two types of malicious code are very different.

show abstract

“…Intrusion and Extrusion detection systems can be classified as shown in Fig 2. The following are the primary characteristics [1] discussed:…”

Section: Classification Of Ids and Edsmentioning

confidence: 99%

A Comprehensive Study on Classification of Passive Intrusion and Extrusion Detection System

Lekha¹,

Padmavathi²

2013

Computer Science &Amp; Information Technology ( CS &Amp; IT )

View full text Add to dashboard Cite

Cyber criminals compromise Integrity, Availability and Confidentiality of network resources in cyber space and cause remote class intrusions such as U2R, R2L, DoS and probe/scan system attacks .To handle these intrusions, Cyber Security uses three audit and monitoring systems namely Intrusion Prevention Systems (IPS), Intrusion Detection Systems (IDS). Intrusion Detection System (IDS) monitors only inbound traffic which is insufficient to prevent botnet systems. A system to monitor outbound traffic is named as Extrusion Detection System (EDS). Therefore a hybrid system should be designed to handle both inbound and outbound traffic.Due to the increased false alarms preventive systems do not suite to an organizational network. The goal of this paper is to devise a taxonomy for cyber security and study the existing methods of Intrusion and Extrusion Detection systems based on three primary characteristics. The metrics used to evaluate IDS and EDS are also presented.

show abstract

Intrusion Detection: A Survey

Cited by 145 publications

References 1 publication

Hybrid Intrusion Detection Systems (HIDS) using Fuzzy Logic

Hybrid Intrusion Detection Systems (HIDS) using Fuzzy Logic

What's Your Major Threat? On the Differences between the Network Behavior of Targeted and Commodity Malware

A Comprehensive Study on Classification of Passive Intrusion and Extrusion Detection System

Contact Info

Product

Resources

About