Visible to the public Network Intrusion Detection System using attack behavior classification

TitleNetwork Intrusion Detection System using attack behavior classification
Publication TypeConference Paper
Year of Publication2014
AuthorsAl-Jarrah, O., Arafat, A.
Conference NameInformation and Communication Systems (ICICS), 2014 5th International Conference on
Date PublishedApril
Keywordsalert module, attack behavior classification, computer network security, computer security systems, HIDS, Host sweep, host sweep attacks, host-based intrusion detection system, Intrusion detection, Intrusion Detection Systems, IP networks, network intrusion detection system, Network probe attack, network probe attacks, neural nets, Neural networks, NIDS, packet capture engine, pattern classification, Pattern recognition, Port scan, port scan attacks, Ports (Computers), preprocessor, Probes, Protocols, reconnaissance attacks, TDNN neural network, TDNN neural network structure, unauthorized accesses

Intrusion Detection Systems (IDS) have become a necessity in computer security systems because of the increase in unauthorized accesses and attacks. Intrusion Detection is a major component in computer security systems that can be classified as Host-based Intrusion Detection System (HIDS), which protects a certain host or system and Network-based Intrusion detection system (NIDS), which protects a network of hosts and systems. This paper addresses Probes attacks or reconnaissance attacks, which try to collect any possible relevant information in the network. Network probe attacks have two types: Host Sweep and Port Scan attacks. Host Sweep attacks determine the hosts that exist in the network, while port scan attacks determine the available services that exist in the network. This paper uses an intelligent system to maximize the recognition rate of network attacks by embedding the temporal behavior of the attacks into a TDNN neural network structure. The proposed system consists of five modules: packet capture engine, preprocessor, pattern recognition, classification, and monitoring and alert module. We have tested the system in a real environment where it has shown good capability in detecting attacks. In addition, the system has been tested using DARPA 1998 dataset with 100% recognition rate. In fact, our system can recognize attacks in a constant time.

Citation Key6841978