Hybrid Intrusion Detection with Weighted Signature Generation

An intrusion detection system (IDS) inspects all inbound and outbound network activity and identifies suspicious patterns that may indicate a network or system attack from someone attempting to break into or compromise a system IDS. Since IDS only works by matching the incoming transaction record with its predefined attack patterns stored in the database, it is necessary to develop a system which can automatically detect any new attack and record it in the database. Hence, we propose the Anomaly Detection System (ADS) as an enhancement in mending IDS loopholes by using a technique called Signature-based generation which analyzes normal profile against anomaly profile and automatically build its signature to be later on stored in the database. The paper reports the design principles and evaluation results of a new experimental hybrid intrusion detection system(HIDS) by combining the advantages of low false-positive rate of signature-based intrusion detection system (IDS) and the ability of anomaly detection system (ADS) to detect novel unknown attacks. A weighted signature generation scheme is developed to integrate ADS with SNORT by extracting signatures from anomalies detected and adds signature generated into the SNORT signature database for fast and accurate intrusion