• Title/Summary/Keyword: real time intrusion detection system

Search Result 86, Processing Time 0.033 seconds

Robust Real-time Intrusion Detection System

  • Kim, Byung-Joo;Kim, Il-Kon
    • Journal of Information Processing Systems
    • /
    • v.1 no.1 s.1
    • /
    • pp.9-13
    • /
    • 2005
  • Computer security has become a critical issue with the rapid development of business and other transaction systems over the Internet. The application of artificial intelligence, machine learning and data mining techniques to intrusion detection systems has been increasing recently. But most research is focused on improving the classification performance of a classifier. Selecting important features from input data leads to simplification of the problem, and faster and more accurate detection rates. Thus selecting important features is an important issue in intrusion detection. Another issue in intrusion detection is that most of the intrusion detection systems are performed by off-line and it is not a suitable method for a real-time intrusion detection system. In this paper, we develop the real-time intrusion detection system, which combines an on-line feature extraction method with the Least Squares Support Vector Machine classifier. Applying the proposed system to KDD CUP 99 data, experimental results show that it has a remarkable feature extraction and classification performance compared to existing off-line intrusion detection systems.

A Study on Developing Intrusion Detection System Using APEX : A Collaborative Research Project with Jade Solution Company (APEX 기반 침입 탐지 시스템 개발에 관한 연구 : (주)제이드 솔류션과 공동 연구)

  • Kim, Byung-Joo
    • The Journal of Korea Institute of Information, Electronics, and Communication Technology
    • /
    • v.10 no.1
    • /
    • pp.38-45
    • /
    • 2017
  • Attacking of computer and network is increasing as information processing technology heavily depends on computer and network. To prevent the attack of system and network, host and network based intrusion detection system has developed. But previous rule based system has a lot of difficulties. For this reason demand for developing a intrusion detection system which detects and cope with the attack of system and network resource in real time. In this paper we develop a real time intrusion detection system which is combination of APEX and LS-SVM classifier. Proposed system is for nonlinear data and guarantees convergence. While real time processing system has its advantages, such as memory efficiency and allowing a new training data, it also has its disadvantages of inaccuracy compared to batch way. Therefore proposed real time intrusion detection system shows similar performance in accuracy compared to batch way intrusion detection system, it can be deployed on a commercial scale.

Design and Analysis of Real-time Intrusion Detection Model for Distributed Environment (분산환경을 위한 실시간 침입 탐지 모델의 설계)

  • 이문구;전문석
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.9 no.1
    • /
    • pp.71-84
    • /
    • 1999
  • The most of intrusion detection methods do not detect intrusion when it happens. To solve the problem, we are studying a real-time intrusion detection. Because a previous intrusion detection system(IDS) is running on the host level, it difficult to port and to extend to other system on the network level that distributed environment. Also IDS provides the confidentiality of messages when it sends each other. This paper proposes a model of real-time intrusion detection using agents. It applies to distributed environment using an extensibility and communication mechanism among agents, supports a portability, an extensibility and a confidentiality of IDS.

A Real-Time Intrusion Detection based on Monitoring in Network Security (네트워크 보안에서 모니터링 기반 실시간 침입 탐지)

  • Lim, Seung-Cheol
    • The Journal of the Institute of Internet, Broadcasting and Communication
    • /
    • v.13 no.3
    • /
    • pp.9-15
    • /
    • 2013
  • Recently, Intrusion detection system is an important technology in computer network system because of has seen a dramatic increase in the number of attacks. The most of intrusion detection methods do not detect intrusion on real-time because difficult to analyze an auditing data for intrusions. A network intrusion detection system is used to monitors the activities of individual users, groups, remote hosts and entire systems, and detects suspected security violations, by both insider and outsiders, as they occur. It is learns user's behavior patterns over time and detects behavior that deviates from these patterns. In this paper has rule-based component that can be used to encode information about known system vulnerabilities and intrusion scenarios. Integrating the two approaches makes Intrusion Detection System a comprehensive system for detecting intrusions as well as misuse by authorized users or Anomaly users (unauthorized users) using RFM analysis methodology and monitoring collect data from sensor Intrusion Detection System(IDS).

Real-time Intrusion-Detection Parallel System for the Prevention of Anomalous Computer Behaviours (비정상적인 컴퓨터 행위 방지를 위한 실시간 침입 탐지 병렬 시스템에 관한 연구)

  • 유은진;전문석
    • Review of KIISC
    • /
    • v.5 no.2
    • /
    • pp.32-48
    • /
    • 1995
  • Our paper describes an Intrusion Detection Parallel System(IDPS) which detects an anomaly activity corresponding to the actions that interaction between near detection events. IDES uses parallel inductive approaches regarding the problem of real-time anomaly behavior detection on rule-based system. This approach uses sequential rule that describes user's behavior and characteristics dependent on time. and that audits user's activities by using rule base as data base to store user's behavior pattern. When user's activity deviates significantly from expected behavior described in rule base. anomaly behaviors are recorded. Observed behavior is flagged as a potential intrusion if it deviates significantly from the expected behavior or if it triggers a rule in the parallel inductive system.

  • PDF

Design Of Intrusion Detection System Using Background Machine Learning

  • Kim, Hyung-Hoon;Cho, Jeong-Ran
    • Journal of the Korea Society of Computer and Information
    • /
    • v.24 no.5
    • /
    • pp.149-156
    • /
    • 2019
  • The existing subtract image based intrusion detection system for CCTV digital images has a problem that it can not distinguish intruders from moving backgrounds that exist in the natural environment. In this paper, we tried to solve the problems of existing system by designing real - time intrusion detection system for CCTV digital image by combining subtract image based intrusion detection method and background learning artificial neural network technology. Our proposed system consists of three steps: subtract image based intrusion detection, background artificial neural network learning stage, and background artificial neural network evaluation stage. The final intrusion detection result is a combination of result of the subtract image based intrusion detection and the final intrusion detection result of the background artificial neural network. The step of subtract image based intrusion detection is a step of determining the occurrence of intrusion by obtaining a difference image between the background cumulative average image and the current frame image. In the background artificial neural network learning, the background is learned in a situation in which no intrusion occurs, and it is learned by dividing into a detection window unit set by the user. In the background artificial neural network evaluation, the learned background artificial neural network is used to produce background recognition or intrusion detection in the detection window unit. The proposed background learning intrusion detection system is able to detect intrusion more precisely than existing subtract image based intrusion detection system and adaptively execute machine learning on the background so that it can be operated as highly practical intrusion detection system.

Quality Evaluation Model for Intrusion Detection System based on Security and Performance (보안성과 성능에 따른 침입탐지시스템의 품질평가 모델)

  • Lee, Ha-Young;Yang, Hae-Sool
    • Journal of Digital Convergence
    • /
    • v.12 no.6
    • /
    • pp.289-295
    • /
    • 2014
  • Intrusion detection system is a means of security that detects abnormal use and illegal intension in advance in real time and reenforce the security of enterprises. Performance of intrusion detection system is judged by information collection, intrusion analysis, intrusion response, review and protection of intrusion detection result, reaction, loss protection that belong to the area of intrusion detection. In this paper, we developed a evaluation model based on the requirements of intrusion detection system and ISO international standard about software product evaluation.

An Intrusion Detection System based on the Artificial Neural Network for Real Time Detection (실시간 탐지를 위한 인공신경망 기반의 네트워크 침입탐지 시스템)

  • Kim, Tae Hee;Kang, Seung Ho
    • Convergence Security Journal
    • /
    • v.17 no.1
    • /
    • pp.31-38
    • /
    • 2017
  • As the cyber-attacks through the networks advance, it is difficult for the intrusion detection system based on the simple rules to detect the novel type of attacks such as Advanced Persistent Threat(APT) attack. At present, many types of research have been focused on the application of machine learning techniques to the intrusion detection system in order to detect previously unknown attacks. In the case of using the machine learning techniques, the performance of the intrusion detection system largely depends on the feature set which is used as an input to the system. Generally, more features increase the accuracy of the intrusion detection system whereas they cause a problem when fast responses are required owing to their large elapsed time. In this paper, we present a network intrusion detection system based on artificial neural network, which adopts a multi-objective genetic algorithm to satisfy the both requirements: accuracy, and fast response. The comparison between the proposing approach and previously proposed other approaches is conducted against NSL_KDD data set for the evaluation of the performance of the proposing approach.

A Design of false alarm analysis framework of intrusion detection system by using incremental mining method (점진적 마이닝 기법을 적용한 침입탐지 시스템의 오 경보 분석 프레임워크 설계)

  • Kim Eun-Hee;Ryu Keun-Ho
    • The KIPS Transactions:PartC
    • /
    • v.13C no.3 s.106
    • /
    • pp.295-302
    • /
    • 2006
  • An intrusion detection system writes a lot of alarms against attack behaviors in real time. These alarms contain not only actual attack alarms, but also false alarms that are mistakes made by the intrusion detection system. False alarms are the main reason that reduces the efficiency of the intrusion detection system, and we propose framework for false alarms analysis in the paper. Also, we apply an incremental data mining method for pattern analysis of false alarms increasing continuously. The framework consists of GUI, DB Manager, Alert Preprocessor, and False Alarm Analyzer. We analyze the false alarms increasingly through the experiment of the proposed framework and show that false alarms are reduced by applying the analyzed false alarm rules in the intrusion detection system.

Intrusion Detection System using Pattern Classification with Hashing Technique (패턴분류와 해싱기법을 이용한 침입탐지 시스템)

  • 윤은준;김현성;부기동
    • Journal of Korea Society of Industrial Information Systems
    • /
    • v.8 no.1
    • /
    • pp.75-82
    • /
    • 2003
  • Computer and network security has recently become a popular subject due to the explosive growth of the Internet Especially, attacks based on malformed packet are difficult to detect because these attacks use the skill of bypassing the intrusion detection system and Firewall. This paper designs and implements a network-based intrusion detection system (NIDS) which detects intrusions with malformed-packets in real-time. First, signatures, rules in NIDS like Snouts rule files, are classified using similar properties between signatures NIDS creates a rule tree applying hashing technique based on the classification. As a result the system can efficiently perform intrusion detection.

  • PDF