Abstract:Cyber-attacks are becoming increasingly sophisticated, posing greater challenges in accurately detecting intrusions. Failure to prevent intrusions could degrade the credibility of security services. Intrusion Detection System (IDS) is one of the most effective paradigms to identify attack behaviors. This paper proposes a novel hybrid intrusion detection system called DST-IDS. The proposed method employs both packet-based and flow-based intrusion detection techniques and combines them with Dempster-Shafer Theory (DST). DST-IDS has an ensemble-like framework. It takes both traffic flows and their first N packets as inputs; flow-based IDS aims to predict traffic flows and packet-based IDS detects attacks in the corresponding packets; DST is then applied to fuse predictions of flow-based IDS and packet-based IDS to a final detection result. We also design a novel data collection/processing tool in DST-IDS to reduce the data volume required to perform intrusion detection and enable early detection. In addition, DST-IDS is designed to work with heterogeneous data distribution where the distribution of the training dataset can differ from the data distribution during implementation. This property drastically improves the practicality of DST-IDS. We run experiments on public datasets and real networks to evaluate the proposed method. The experimental results show that DST-IDS outperforms state-of-the-art benchmarks in terms of intrusion detection accuracy and detection speed. Particularly, DST-IDS provides real-time detection in real networks and handles well heterogeneous data distribution.

A Sampling Method for Intrusion Detection System

Sampling Method for IDS in High Bandwidth Network

Comparison of Two Sampling-Based Data Collection Mechanisms for Intrusion Detection System.

An Analysis of Packet Sampling Strategy of Network-based Intrusion Detection System

Data Collection For Intrusion Detection System Based On Stratified Random Sampling

A data collection model for intrusion detection system based on simple random sampling

Intrusion Detection And Simulation For High-Speed Networks

CIDS: Adapting Legacy Intrusion Detection Systems to the Cloud with Hybrid Sampling.

Techniques of Building a Scalable, Efficient Intrusion Monitoring Architecture

A Parallel Intrusion Detection System for High-Speed Networks

Research on Intrusion Detection System in High-Speed Network

A Load Balancing Algorithm For High Speed Intrusion Detection

Hstcp: A High-Speed Traffic Collection Platform for Intrusion Detection/Prevention Based on Sampling on Fpgas

An Intrusion Detection Mechanism Based on Sampling and Feedback for Cloud Computing

A2C: Anti-Attack Counters for Traffic Measurement

Accurate and Efficient Traffic Monitoring Using Adaptive Non-Linear Sampling Method

SE-IDS: A Sample Equalization Method for Intrusion Detection in Industrial Control System

New Trend of Intrusion Detection System for High-speed Networks

The Design and Evaluation of A Terminal-Matching Adaptive Sampling Algorithm

A Hybrid Sampling Approach for Network Flow Monitoring.

Hybrid Intrusion Detection System Based on Dempster-Shafer Evidence Theory