Modeling Intrusion Detection with Self Similar Traffic in Enterprise Networks

Abstract

Most of the existing networks (e.g., telecommunications, industrial control, enterprise networks etc.) have been globally connected to open computer networks (Internet) in order to decentralize planning, management and controls in business. Most of these networks were originally designed without security considerations, thereby making them vulnerable to cyber attacks. This has given rise to the need for efficient and scalable intrusion detection systems (IDSs) and intrusion prevention systems (IPSs) to secure existing networks. Existing IDSs and IPSs have five major limitations, which prevent them from securing networks absolutely. It has been proven that the right combination of security techniques always protects networks better. This approach used change in Hurst parameter and a signal processing application of wavelets (i.e., multi-resolution technique) to develop an IDS. The novelty of our proposed IDS technique presented in this chapter lies in its efficiency and ability to eliminate most of the limitations of existing IDSs and IPSs, thereby ensuring high level network protection.