A SYSTEMATIC TECHNIQUES ENSEMBLE OF INTRUSION DETECTION SYSTEM

ATTENTION:

BEFORE YOU READ THE ABSTRACT OR CHAPTER ONE OF THE PROJECT TOPICS BELOW, PLEASE READ THE INFORMATION BELOW.THANK YOU!

INFORMATION:

YOU CAN GET THE COMPLETE PROJECT OF THE TOPIC BELOW. THE FULL PROJECT COST N5,000 ONLY. THE FULL INFORMATION ON HOW TO PAY AND GET THE COMPLETE PROJECT IS AT THE BOTTOM OF THIS PAGE. OR

YOU CAN CALL: 08068231953, 08137701720

WHATSAPP US ON: 08137701720

A SYSTEMATIC TECHNIQUES ENSEMBLE OF INTRUSION DETECTION SYSTEM

CHAPTER ONE

INTRODUCTION

1.1 Background of the study

Intrusion detection can be defined as “the process of identifying and responding to malicious activity targeted at computing and networking resources”. The process of intrusion detection involves both detection tools and people. An Intrusion Detection System(IDS) is a software tool used to detect unauthorized access to a computer system or network. Intrusion detection is also defined as the most popular way to detect intrusions is by using the audit data generated by the operating systems. Since almost all activities are logged on a system, it is possible that a manual inspection of these logs would allow intrusions to be detected. It important to analyze the audit data even after an attack has occurred to determine the extent of damage sustained this analysis also helps in tracking down the attacks and in recording the attacks patterns for future detection. A good Intrusion Detection that can be used to analyze audit data for insights makes a valuable tool for information systems. The two types of intrusion detection systems are Anomaly detection system and misuse detection system. In this paper we are going to create a ensemble approach for anomaly and misuse detection system and use the approach as model and compare the result of anomaly detection system and misuse detection system for different parameters using the Soft computing techniques.

The ensemble of classifiers; which is hereafter mentioned as an ensemble learner, has drawn a lot of interest in cybersecurity research, and in an intrusion detection system (IDS) domain is no exception [1–3]. An IDS deals with the proactive and responsive detection of external aggressors and anomalous operations of the server before they make such a massive destruction. As of today, a variety number of cyberattacks has been in perilous situations, placing some organization’s critical infrastructures into risk. A successful attack may lead to difficult consequences such as but not limited to financial loss, operational termination, and confidential information disclosure. Moreover, the larger the organization’s network, the bigger the chance for attackers to exploit. The complexity of the network may also give rise to vulnerabilities and other specific threats. Therefore, security mitigation and protection strategies should be considered mandatory.

A possible protection mechanism such as intrusion detection is indispensable as it involves preventive action used to get rid of any malignant acts within the computer network. An IDS attempts to detect and to block attacks without human intervention by examining network and file access logs, audit trails, and other security-relevant information within the organization. Depending on the detection objectives, an IDS is primarily categorized into two approaches, i.e. anomaly and misuse (signature)-based detection. The former techniques figure out attacks through examining traffic patterns that have deviations from normal patterns. Hence, one merit is that they are able to locate previously unknown attacks, however, they retain to have high false positive rate (FPR). Quite the contrary, the latter performs attack detection based on some known attack signatures. Utilizing a pattern-matching algorithm, an attack pattern candidate in the network is checked by comparing it with those predetermined signatures. This results a lower FPR, but fails to detect novel attack patterns.

An ensemble learner is built upon several trainable classifiers, e.g. base learners. Each base learner is trained and performs prediction for a particular class label, where final prediction is made using a particular blending technique, e.g. a combiner. In the purview of IDS, vast majority studies on combining classifiers have been initially begun with a single rationale, however, it can be assumed that since then the classifier ensembles perform better than an individual classifier because of several justifications, i.e. statistical, computational, and representational reasons. Impressed with such rationales, this paper exploits the use of state-of-the-art ensemble learners in IDSs through a systematic mapping study. Furthermore, it extends to carry out an empirical benchmark of different combiner techniques, providing researchers a perception and knowledge about the present circumstances and future orientations of ensemble learning applied for IDSs.

As mentioned earlier, an IDS attempts to monitoring the organization’s network infrastructure by detecting the malicious activities in a responsive manner. Liao et al. [10] provide a taxonomy of IDSs with respect to four main different dimensions, i.e. system deployment, timeliness, detection strategy, and data source. Specifically, concerning their deployment strategy, IDSs can be categorized into two technology types, i.e. host-based and network-based. The aim of host-based IDSs (HIDS) is to monitor the occurrences that arise in a local computer system and then to give notification about the findings. One example found in HIDS is the hash of the file system. Any untrust behavior is recognized after comparing the differences between the hash value that is currently recalculated and the one formerly saved in the database. Network-based IDSs (NIDS), on the contrary, are designed to monitor network traffic and to detect malicious activities within the network by examining inflowing network packets.

Besides, concerning the timeliness, IDSs can be deployed in offline or online mode, while anomaly or misuse are the two classifications of IDSs in terms of detection method. An IDS can also be categorized w.r.t the data source obtained for the analysis. This includes how the data is collected, types of data, and where the data is acquired from.

1.2 Statement of the problem

Detection Systems using the Standard datasets and to determine the Detection Rate and False Positive Rate. The Machine Learning algorithms are applied to both the categories of Intrusion detection Systems : anomaly detection system and misuse detection systems. The Machine Learning algorithms used in this research are ANN, NBC and SVM. The Standard datasets used are Shonlau’s[13] standard truncated command line dataset for Anomaly detection systems and kddcup’99 dataset [14] for Misuse detection systems.

1.3 Objectives of the study

1. To understand the current trend in ensemble learning-based IDSs

2. To understand types of ensemble learning methods have been commonly used to cope with the issues arise in IDSs

3. To know types of IDS techniques that are developed most? •

4.: To understand the relative performance of ensemble learning methods as compared to single classification algorithms

1.4 Research Questions

RQ1: What is the current trend in ensemble learning-based IDSs?

RQ2: What types of ensemble learning methods have been commonly used to cope with the issues arise in IDSs?

RQ3: What types of IDS techniques that are developed most? •

RQ4: What is the relative performance of ensemble learning methods as compared to single classification algorithms?

1.5 Research Hypothesis

H0: There is no relationship between ensemble learning methods of intrusion detection system and classification algorithms.