ABSTRACT
This paper reports the design principles and evaluation results of a new experimental hybrid intrusion detection system (HIDS). This hybrid system combines the advantages of low false-positive rate of signature-based intrusion detection system (IDS) and the ability of anomaly detection system (ADS) to detect novel unknown attacks. By mining anomalous traffic episodes from Internet connections, we build an ADS that detects anomalies beyond the capabilities of signature-based SNORT or Bro systems. A weighted signature generation scheme is developed to integrate ADS with SNORT by extracting signatures from anomalies detected. HIDS extracts signatures from the output of ADS and adds them into the SNORT signature database for fast and accurate intrusion detection. By testing our HIDS scheme over real-life Internet trace data mixed with 10 days of Massachusetts Institute of Technology/Lincoln Laboratory (MIT/LL) attack data set, our experimental results show a 60 percent detection rate of the HIDS, compared with 30 percent and 22 percent in using the SNORT and Bro systems, respectively. This sharp increase in detection rate is obtained with less than 3 percent false alarms. The signatures generated by ADS upgrade the SNORT performance by 33 percent. The HIDS approach proves the vitality of detecting intrusions and anomalies, simultaneously, by automated data mining and signature generation over Internet connection episodes
TABLE OF CONTENTS
TITLE PAGE
CERTIFICATION
DEDICATION
ACKNOWLEDGEMENT
ABSTRACT
TABLE OF CONTENTS
CHAPTER ONE
INTRODUCTION
1.1 BACKGROUND OF THE STUDY
1.2 STATE OF THE PROBLEM
1.3 PURPOSE OF THE STUDY
1.4 AIMS AND OBJECTIVES
1.5 SCOPE OF STUDY
1.6 LIMITATIONS OF STUDY
1.7 ASSUMPTIONS
1.8 DEFINITION OF TERMS
CHAPTER TWO
LITERATURE REVIEW
CHAPTER THREE
3.1 DESCRIPTION AND ANALYSIS OF EXISTING SYSTEM
3.2 FACT FINDING METHOD USED
3.3 ORGANIZATION STRUCTURE
3.4 OBJECTIVES OF EXISTING SYSTEM
3.5 INPUT, PROCESS AND OUTPUT ANALYSIS
3.6 INFORMATION FLOW DIAGRAMS
3.7 PROBLEMS OF THE EXISTING SYSTEM
3.8 JUSTIFICATION OF THE NEW SYSTEM
CHAPTER FOUR
4.1 DESIGN OF THE NEW SYSTEM
4.2 INPUT SPECIFICATION AND DESIGN
4.3 OUTPUT SPECIFICATION AND DESIGN
4.4 FILE DESIGN
4.5 PROCEDURE CHART
4.6 SYSTEM FLOW CHART
4.7 SYSTEM REQUIREMENTS
CHAPTER FIVE
5.1 IMPLEMENTATION
5.2 PROGRAM DESIGN
5.3 PROGRAM FLOWCHART
5.4 PSEUDO CODE
5.5 SOURCE PROGRAM: TEST RUN
CHAPTER SIX
DOCUMENTATION
CHAPTER SEVEN
7.1 RECOMMENDATION
7.2 CONCLUSION
BIBLIOGRAPHY