Hybridization of Machine Learning Algorithm in Intrusion Detection System

Intrusion Detection System

An Intrusion Detection System (IDS) is a software application that continuously perceives computer network looking for malicious actions or strategy defilements and generates reports. According to recent studies, an average of twenty to forty new vulnerabilities in commonly used networking and computer products are discovered every month. These wide-ranging vulnerabilities in software enlarge or increase today’s insecure computing/networking environment. Hence, such insecure environment has paved way to the ever evolving field of intrusion detection and prevention. The cyberspace’s equivalent to the burglar alarm, intrusion detection systems complement the beleaguered firewall.

Intrusion Detection System is a security mechanism which has been acknowledged by the researchers from all over the world because of their capability to keep track of the network behaviour, so that abnormal behaviour can be detected quickly. The traditional IDS is unable to handle the recent attacks and malwares. Hence, IDS which is a vital element of the network needs to be safeguarded.

Steps of IDS are

• •

  Monitoring and analysing traffic.

• •

  Identifying abnormal activities.

• •

  Assessing severity and raising alarm.

Figure 1 shows the basic architecture of intrusion detection system.

Figure 1.

Basic architecture of intrusion detection system

The Major Components of IDS Include

• •

  Knowledge Base which encompasses pre-processed information provided by network experts and collected by the sensors.

• •

  Configuration Device which provides data related to the present state of the IDS.

• •

  Detector – ID Engine which identifies intrusive actions based on the data collected from sensors and sends an alarm to response component if intrusion occurs.

• •

  Response Component which initiates response if an intrusion is detected.

• •

  Data Gathering Device which is responsible for collecting data from monitored system.

The packets that are received are transmitted over the computer network and captured. Data are collected and pre-processed to remove the noise and irrelevant attributes. Then the pre-processed data are analysed and classified based on their severity actions. If the record is found normal, then it does not need any change in the action, otherwise, it is sent for report generation. Depending on the state of the data, alarms are raised to alert the administrator to handle the state in advance. The attack is modelled in order to facilitate the classification of network data.