Ensemble Defense System: A Hybrid IDS Approach for Effective Cyber Threat Detection

Sarah Alharbi,Arshiya Khan

DOI: https://doi.org/10.1109/ITNAC59571.2023.10368510

2024-01-07

Abstract:Sophisticated cyber attacks present significant challenges for organizations in detecting and preventing such threats. To address this critical need for advanced defense mechanisms, we propose an Ensemble Defense System (EDS). An EDS is a cybersecurity framework aggregating multiple security tools designed to monitor and alert an organization during cyber attacks. The proposed EDS leverages a comprehensive range of Intrusion Detection System (IDS) capabilities by introducing a hybrid of signature-based IDS and anomaly-based IDS tools. It also incorporates Elasticsearch, an open-source Security Information and Event Management (SIEM) tool, to facilitate data analysis and interactive visualization of alerts generated from IDSs. The effectiveness of the EDS is evaluated through a payload from a bash script that executes various attacks, including port scanning, privilege escalation, and Denial-of-Service (DoS). The evaluation demonstrates the EDS's ability to detect diverse cyber attacks.

Cryptography and Security

What problem does this paper attempt to address?

This paper aims to solve the problems of complex network attack detection and defense currently faced in network security. Specifically, the paper proposes an Ensemble Defense System (EDS), which improves the detection efficiency of network attacks by combining multiple Intrusion Detection System (IDS) tools. These IDS tools include signature - based IDS and anomaly - based IDS, as well as the open - source Security Information and Event Management (SIEM) tool Elasticsearch for data analysis and visual display of alerts.

The paper mainly solves the following problems:

1. **The detection challenge of complex network attacks**: Current network attack techniques are becoming increasingly complex, and traditional single IDSs are difficult to effectively cope with. The paper improves the detection ability of various types of network attacks by proposing a hybrid IDS framework that combines the advantages of signature detection and anomaly detection.

2. **Improving detection accuracy and reducing false positive rates**: Signature - based IDS can quickly identify known attacks, but has limited ability to detect unknown threats; while anomaly - based IDS can detect unknown attacks, but is prone to generate a large number of false positives. The EDS proposed in the paper aims to improve detection accuracy while reducing false positive rates by fusing these two methods.

3. **Data management and visualization**: In order to better manage and analyze a large amount of network log data, the paper introduces Elasticsearch as a SIEM tool, providing powerful data search and analysis functions. At the same time, Kibana is used for data visualization, enabling network administrators to more intuitively monitor and respond to potential security threats.

In summary, the main goal of this paper is to improve an organization's detection and defense capabilities in the face of complex network attacks by constructing a comprehensive Ensemble Defense System.