Quantitative intrusion intensity assessment for intrusion detection systems

Abstract

One of the main problems of existing approaches in anomaly detection in intrusion detection system (IDS) is that IDSs provide only binary detection result: intrusion (attack) or normal. If some attack data or normal data is belonged to boundary, they may be classified wrongly. That is a main cause of high false rates and inaccurate detection rates in IDS. We propose a new approach named Quantitative Intrusion Intensity Assessment (QIIA) that exploits proximity metrics computation so that it provides intrusion (or normal) quantitative intensity value. It is capable of representing how an instance of audit data is proximal to intrusion or normal in a numerical value. This can identify unknown intrusion and normal pattern more accurately. Prior to applying QIIA to audit data, we perform feature selection and parameter optimization of detection models to decrease the overheads to process audit data and to enhance detection rates. Random Forests is used to generate proximity metrics that represent the intrusion intensity (and normal instance intensity) in a numerical way. The numerical value is used to determine whether unknown audit data are intrusion or normal. We carry out several experiments on KDD 1999 dataset and the experimental results show the feasibility of our approach. Copyright © 2012 John Wiley & Sons, Ltd.

An analysis of performance factors on Esper‐based stream big data processing in a virtualized environment

“…Complex event processing (CEP) [4,5] has emerged as one of the primary solutions to handle the massive raw event data generated by machines and humans. This technology can be applied to various research areas, such as noise detection [6], social network [7,8], security [9][10][11], health care [12,13], and disaster management [14]. To reflect this trend, many open source communities and enterprises have introduced various CEP solutions, such as Esper [15], Drools [16], and Oracle Event Processing.…”