TY - JOUR
T1 - RePIDS
T2 - A multi tier Real-time Payload-based Intrusion Detection System
AU - Jamdagni, Aruna
AU - Tan, Zhiyuan
AU - He, Xiangjian
AU - Nanda, Priyadarsi
AU - Liu, Ren Ping
N1 - Funding Information:
This work was supported by the Australian Postgraduate Awards (APA), the University of Technology Sydney (UTS) International Research Scholarship (IRS) and the Commonwealth Scientific and Industrial Research Organisation (CSIRO) Information and Communication Technologies (ICT) Centre Top-up Scholarships.
Funding Information:
Xiangjian He is a Professor of Computer Science, School of Computing and Communications. He is also Director of Computer Vision and Pattern Recognition group, and a Deputy Director of Research Centre for Innovation in IT Services and Applications (iNEXT) at the University of Technology, Sydney (UTS). He is an IEEE Senior Member. He has been awarded ‘Internationally Registered Technology Specialist’ by International Technology Institute (ITI). His research interests are image processing, pattern recognition, computer vision and Network security. He is in the editorial boards of seven international journals. He has received various research grants including four national Research Grants awarded by Australian Research Council (ARC).
PY - 2013/2/26
Y1 - 2013/2/26
N2 - Intrusion Detection System (IDS) deals with huge amount of network traffic and uses large feature set to discriminate normal pattern and intrusive pattern. However, most of existing systems lack the ability to process data for real-time anomaly detection. In this paper, we propose a 3-Tier Iterative Feature Selection Engine (IFSEng) for feature subspace selection. Principal Component Analysis (PCA) technique is used for the pre-processing of data. Mahalanobis Distance Map (MDM) is used to discover hidden correlations between the features and between the packets. We also propose a novel Real-time Payload-based Intrusion Detection System (RePIDS) that integrates a 3-Tier IFSEng and the MDM approach. Mahalanobis Distance (MD) dissimilarity criterion is used to classify each packet as either a normal or an attack packet. The effectiveness of the proposed RePIDS is evaluated using DARPA 99 dataset and Georgia Institute of Technology attack dataset. The traffic for Web-based application is considered for validating our model. F-value, a criterion, is used to evaluate the detection performance of RePIDS. Experimental results show that RePIDS achieves better performance (high F-values, 0.9958 for DARPA 99 dataset and 0.976 for Georgia Institute of Technology attack dataset respectively, with only 0.85% false alarm rate) and lower computational complexity when compared against two state-of-the-art payload-based intrusion detection systems. Additionally, it has 1.3 time higher throughput in comparison with real scenario of medium sized enterprise network.
AB - Intrusion Detection System (IDS) deals with huge amount of network traffic and uses large feature set to discriminate normal pattern and intrusive pattern. However, most of existing systems lack the ability to process data for real-time anomaly detection. In this paper, we propose a 3-Tier Iterative Feature Selection Engine (IFSEng) for feature subspace selection. Principal Component Analysis (PCA) technique is used for the pre-processing of data. Mahalanobis Distance Map (MDM) is used to discover hidden correlations between the features and between the packets. We also propose a novel Real-time Payload-based Intrusion Detection System (RePIDS) that integrates a 3-Tier IFSEng and the MDM approach. Mahalanobis Distance (MD) dissimilarity criterion is used to classify each packet as either a normal or an attack packet. The effectiveness of the proposed RePIDS is evaluated using DARPA 99 dataset and Georgia Institute of Technology attack dataset. The traffic for Web-based application is considered for validating our model. F-value, a criterion, is used to evaluate the detection performance of RePIDS. Experimental results show that RePIDS achieves better performance (high F-values, 0.9958 for DARPA 99 dataset and 0.976 for Georgia Institute of Technology attack dataset respectively, with only 0.85% false alarm rate) and lower computational complexity when compared against two state-of-the-art payload-based intrusion detection systems. Additionally, it has 1.3 time higher throughput in comparison with real scenario of medium sized enterprise network.
KW - Data pre-processing
KW - Intrusion detection
KW - Iterative feature selection
KW - Mahalanobis Distance Map
KW - Principal component analysis
KW - Principal components
UR - http://www.scopus.com/inward/record.url?scp=84875222968&partnerID=8YFLogxK
U2 - 10.1016/j.comnet.2012.10.002
DO - 10.1016/j.comnet.2012.10.002
M3 - Review article
AN - SCOPUS:84875222968
SN - 1389-1286
VL - 57
SP - 811
EP - 824
JO - Computer Networks
JF - Computer Networks
IS - 3
ER -