Inefficiency of IDS Static Anomaly Detectors in Real-World Networks

Edward Guillen, Jeisson Sánchez and Rafael Paez
Additional contact information
Edward Guillen: Telecommunication Engineering Department, Nueva Granada Military University, Bogotá 110911, Colombia
Jeisson Sánchez: Telecommunication Engineering Department, Nueva Granada Military University, Bogotá 110911, Colombia
Rafael Paez: Engineering Systems Department, Xaverian University, Bogotá 110911, Colombia

Future Internet, 2015, vol. 7, issue 2, 1-16

Abstract: A wide range of IDS implementations with anomaly detection modules have been deployed. In general, those modules depend on intrusion knowledge databases, such as Knowledge Discovery Dataset (KDD99), Center for Applied Internet Data Analysis (CAIDA) or Community Resource for Archiving Wireless Data at Dartmouth (CRAWDAD), among others. Once the database is analyzed and a machine learning method is employed to generate detectors, some classes of new detectors are created. Thereafter, detectors are supposed to be deployed in real network environments in order to achieve detection with good results for false positives and detection rates. Since the traffic behavior is quite different according to the user’s network activities over available services, restrictions and applications, it is supposed that behavioral-based detectors are not well suited to all kind of networks. This paper presents the differences of detection results between some network scenarios by applying traditional detectors that were calculated with artificial neural networks. The same detector is deployed in different scenarios to measure the efficiency or inefficiency of static training detectors.

Keywords: NIDS; knowledge database; artificial neural networks; anomaly detection; information security; intelligent detection (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2015
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/7/2/94/pdf (application/pdf)
https://www.mdpi.com/1999-5903/7/2/94/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:7:y:2015:i:2:p:94-109:d:49244

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().