Survey of intrusion detection systems: techniques, datasets and challenges

Abstract

Cyber-attacks are becoming more sophisticated and thereby presenting increasing challenges in accurately detecting intrusions. Failure to prevent the intrusions could degrade the credibility of security services, e.g. data confidentiality, integrity, and availability. Numerous intrusion detection methods have been proposed in the literature to tackle computer security threats, which can be broadly classified into Signature-based Intrusion Detection Systems (SIDS) and Anomaly-based Intrusion Detection Systems (AIDS). This survey paper presents a taxonomy of contemporary IDS, a comprehensive review of notable recent works, and an overview of the datasets commonly used for evaluation purposes. It also presents evasion techniques used by attackers to avoid detection and discusses future research challenges to counter such techniques so as to make computer systems more secure.

Hybrid Intrusion Detection System Based on the Stacking Ensemble of C5 Decision Tree Classifier and One Class Support Vector Machine

“…Table 1 shows the IDS techniques and datasets covered by different intrusion detection system survey papers. Khraisat et al presented a survey of current intrusion detection systems, which was a wide-ranging review of ID technqiues, and the datasets usually employed for evaluation purposes [4]. Several intrusion detection system techniques that have been developed to improve the detection rate.…”

“…Intrusion detection systems (IDS) detect suspicious activities and known threats and generate alerts. Intrusions could be identified as any activity that causes damage to an information system [4]. IDS could be software or hardware systems capable of identifying any such malicious activities in computer systems.…”

“…If an intruder starts transacting on a stolen account, which could be misidentified as the normal user's activity, then it generates an alarm. Secondly, it is very difficult for a cybercriminal to learn what a normal user's behavior is without producing alerts, as the system is constructed from customized profiles [4].…”

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

“…The simulation results were displayed using a confusion matrix, which is shown in Table 1. The confusion matrix was designed for a two class classifier and was useful to evaluate the performance of the IDS [36]. After calculating the predicted value x t , the traffic prediction values were recovered by inverse difference and exponentiation.…”

“…To evaluate the performance of the proposed method, four metrics were selected, the overall accuracy decision rates, false positive rate, false negative rate, and precision rate [36,37].…”