On-line Adaptive IDS Scheme for Detecting Unknown Network Attacks using HMM Models
Free download B.Tech, M.Tech, MCA, M.Sc Computers Projects Based on NETWORKING
TAn important problem in designing IDS schemes is an optimal trade-off between good detection and false alarm rate. Specifically, in order to detect unknown network attacks, existing IDS schemes use anomaly detection which introduces a high false alarm rate. In this thesis we propose an IDS scheme based on overall behavior of the network. We capture the behavior with probabilistic models (HMM) and use only limited logic information about attacks. Once we set the detection rate to be high, we filter out false positives through stages. The key idea is to use probabilistic models so that even an unknown attack can be detected, as well as a variation of a previously known attack. The scheme is adaptive and real-time. Simulation study showed that we can have a perfect detection of both known and unknown attacks while maintaining a very low false alarm rate.
Contents
1 Introduction
1.1 Intrusion Detection System
1.2 Intrusion Detection System terminology
1.3 IDS Categories
1.3.1 Application IDS
1.3.2 Consoles
1.3.3 File Integrity Checkers
1.3.4 Honeypots
1.3.5 Host-based IDS
1.3.6 Hybrid IDS
1.3.7 Network IDS (NIDS)
1.3.8 Network Node IDS (NNIDS)
1.3.9 Personal Firewall
1.3.10 Target-based IDS
2 HMM problems
2.1 Solving basic HMM problems
2.1.1 Problem 1.
2.1.2 Problem 2.
2.1.3 Problem 3.
3 Data set
3.1 Data transformation
3.2 Attack schedule
3.3 The three attacks
3.3.1 Eject
3.3.2 Ffbconfig
3.3.3 Fdformat
4 Proposed IDS scheme: Introduction and Phase 1 – Initialization
4.1 Normal Databases
4.1.1 Normal HMM models
4.1.2 Normal sample sequences
4.2 Attack Databases
4.2.1 Attack Instance Vocabulary Database
4.2.2 Attack Sequence Database
4.2.3 New initialized HMM model
5 Proposed IDS scheme: Phase 2 – Parallel testing and training
5.1 Testing
5.2 Training
6 Proposed IDS scheme: Phase 3 – Logic
7 Proposed IDS scheme: Phase 4 – Verification
8 Proposed IDS scheme: Phase 5 – Adaptive phase
9 Results
9.1 Known attack detection and classication
9.2 Unknown attack detection and classification
9.3 Normal behavior classification – lowering false alarm rate
10 Conclusions
Bibliography
http://studentyogi.com/?attachment_id=2862
