Systematization of metrics in intrusion detection systems

Intrusion detection assumes paramount importance in this information era due to its capability of providing security protection to information systems. In addition to advancing the specific intrusion detection techniques, substantial efforts have been devoted to the taxonomy of existing IDSs, mostly focusing on the methodology, audit source and architecture aspects. The employed metric is another decisive factor of IDS performance, yet a systematized understanding in this aspect is still lacking. As an initial effort towards this objective, a categorization of IDS metrics is proposed in this work, where existing IDS metrics are divided into four types - information theoretic, probabilistic, proximity-based, and reliability-based metrics. Simulation studies of several intrusion detection algorithms that match the proposed categorization are also conducted based on the KDD'99 dataset.

[1]  Eamonn J. Keogh,et al.  Towards parameter-free data mining , 2004, KDD.

[2]  Jun Li,et al.  Early statistical anomaly intrusion detection of DOS attacks using MIB traffic parameters , 2003, IEEE Systems, Man and Cybernetics SocietyInformation Assurance Workshop, 2003..

[3]  Nong Ye,et al.  A Markov Chain Model of Temporal Behavior for Anomaly Detection , 2000 .

[4]  Nan Wang,et al.  An Anomaly Detection Algorithm Based on Lossless Compression , 2012, 2012 IEEE Seventh International Conference on Networking, Architecture, and Storage.

[5]  Marc Dacier,et al.  Towards a taxonomy of intrusion-detection systems , 1999, Comput. Networks.

[6]  Ravi Jain,et al.  Intelligent systems and soft computing , 2003, 36th Annual Hawaii International Conference on System Sciences, 2003. Proceedings of the.

[7]  Navdeep Singh,et al.  A Survey of Intrusion Detection Techniques , 2013 .

[8]  Vipin Kumar,et al.  Anomaly Detection for Discrete Sequences: A Survey , 2012, IEEE Transactions on Knowledge and Data Engineering.

[9]  Carla E. Brodley,et al.  Temporal sequence learning and data reduction for anomaly detection , 1998, CCS '98.

[10]  Yi Hu,et al.  A data mining approach for database intrusion detection , 2004, SAC '04.

[11]  Stuart Staniford-Chen,et al.  Practical Automated Detection of Stealthy Portscans , 2002, J. Comput. Secur..