Performance Analysis of Soft Computing Based Anomaly Detectors

Anomaly detectors have become a necessary component of the computer and information security framework. Some of the numerous drawbacks experienced by the current Anomaly detectors are large number of false positive and false negative alarms, difficulty in processing huge amount of traffic in real time, inadequacy in novel attack recognition and non-scalability. Consequently their efficacy in protecting against anomalies is limited. The use of soft computing techniques like Genetic algorithms, Neural networks and Fuzzy logic in implementing Anomaly detection is perused in this paper. Additionally, a few novel approaches for the detection of anomalies by identifying user actions and network traffic that might compromise a system's secure state, is also proposed. A potential solution to the problem has been contemplated, by comparing the performance of these systems based on various criteria. Characterization of the behavior of a single user (Host based) or a network (Network based) and recognition of anomalies through observation of deviation from normal behavior patterns are conducted to arrive at the solution. The implementations of Genetic algorithm based Anomaly detection system (GAAD), Neural network based Anomaly detection system (NNAD) and Fuzzy Logic based system (FLAD) are reported. Interesting conclusions are deduced from an exhaustive evaluation and comparison of the performance of these systems enabling an administrator to choose the best solution for a given scenario.