Abstract:Cyber-attacks are becoming increasingly sophisticated, posing greater challenges in accurately detecting intrusions. Failure to prevent intrusions could degrade the credibility of security services. Intrusion Detection System (IDS) is one of the most effective paradigms to identify attack behaviors. This paper proposes a novel hybrid intrusion detection system called DST-IDS. The proposed method employs both packet-based and flow-based intrusion detection techniques and combines them with Dempster-Shafer Theory (DST). DST-IDS has an ensemble-like framework. It takes both traffic flows and their first N packets as inputs; flow-based IDS aims to predict traffic flows and packet-based IDS detects attacks in the corresponding packets; DST is then applied to fuse predictions of flow-based IDS and packet-based IDS to a final detection result. We also design a novel data collection/processing tool in DST-IDS to reduce the data volume required to perform intrusion detection and enable early detection. In addition, DST-IDS is designed to work with heterogeneous data distribution where the distribution of the training dataset can differ from the data distribution during implementation. This property drastically improves the practicality of DST-IDS. We run experiments on public datasets and real networks to evaluate the proposed method. The experimental results show that DST-IDS outperforms state-of-the-art benchmarks in terms of intrusion detection accuracy and detection speed. Particularly, DST-IDS provides real-time detection in real networks and handles well heterogeneous data distribution.

Intrusion Detection Methods in Communication-Based Train Control Systems Based on Relative Entropy and Trust Evaluation

Hybrid Intrusion Detection System for Complicated Network

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

A Novel Machine Learning Based Intrusion Detection Method for 5G Empowered CBTC Systems

A transfer learning-based intrusion detection system for zero-day attack in communication-based train control system

TCE-IDS: Time Interval Conditional Entropy- Based Intrusion Detection System for Automotive Controller Area Networks

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

Research on Information Security Interaction Based on Behavior Trust Measurement Mechanism

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

An Entropy Analysis based Intrusion Detection System for Controller Area Network in Vehicles

Survey on Formal Method of Trustworthy Construction for Communication-Based Train Control Systems

Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks

An Intrusion Detection System Based on the Double-Decision-Tree Method for In-Vehicle Network

Hybrid Intrusion Detection Mechanisms for Integrated Electronic Systems.

An Evidence Theoretic Approach for Traffic Signal Intrusion Detection

An Entropy-based Method for Attack Detection in Large Scale Network

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP

An Intrusion Detection System Based on Machine Learning for CAN-Bus.

High-Confidence Fault Diagnosis for Train-Ground Wireless Communication Network of CBTC

Hybrid Intrusion Detection System Based on Dempster-Shafer Evidence Theory

Detecting Anomalies in Distributed Control Systems by Modeling Traffic Behaviors