One of the main problems of existing approaches in anomaly detection in intrusion detection system (IDS) is that IDSs provide only binary detection result: intrusion (attack) or normal. If some attack data or normal data is belonged to boundary, they may be classified wrongly. That is a main cause of high false rates and inaccurate detection rates in IDS. We propose a new approach named Quantit...

The study examined the detection of attacks against computer networks, which is becoming a harder problem to solve in the field of Network security. A problem with current intrusion detection systems is that they have many false positive and false negative events. Most of the existing Intrusion detection systems implemented depend on rule-based expert systems where new attacks are not detectabl...

Intrusion detection systems (IDSs) must meet the security goals while minimizing risks of wrong detections. In this paper, we study the issue of building a risk-sensitive intrusion detection mode1. To determinate whether a system calls sequence is normal or not, we consider not only the probability of this sequence belonging to normal sequences set or intrusion sequences set, but also the risk ...

We present a probabilistic model of an intrusion in a marked renewal process. Given a process and a sequence of events, an intrusion is a subsequence of events that is not produced by the process. Applications of the model are, for example, online payment fraud with the fraudster taking over a user’s account and performing payments on the user’s behalf, or unexpected equipment failures due to u...

Many methods have been developed to secure the network infrastructure and communication over the Internet. Intrusion detection is a relatively new addition to such techniques. Intrusion detection systems (IDS) are used to find out if someone has intrusion into or is trying to get it the network. One big problem is amount of Intrusion which is increasing day by day. We need to know about network...

Internet provides huge information and value to the users but at the same time access to the internet is prone to increasing number of attacks. Tracing the source of the attacking packet is very difficult because of stateless and destination based routing infrastructure of Internet. If the attacks are detected successfully, then preventive measures for attacks can be taken. Host based and netwo...

As computer systems become more complex and more widely distributed, it is becoming increasingly difficult to remove all vulnerabilities that can potentially be exploited by intruders. Intrusion tolerance is an emerging approach that aims to enable systems to continue functioning in spite of successful intrusions. Before intrusion tolerance is accepted as an approach to security, there must be ...

Mobile ad hoc networks and wireless sensor networks have promised a wide variety of applications. However, they are often deployed in potentially adverse or even hostile environments. Therefore, they cannot be readily deployed without first addressing security challenges. Intrusion detection systems provide a necessary layer of in-depth protection for wired networks. However, relatively little ...

An intruder may target the ID scheme first in order to facilitate further malicious activities. For an intrusion-detection system that is operating in real time, an intruder could be exposed if they were simply to disable the IDS, a denial-of-service attack. A corrupted intrusion-detection system, however, might report erroneous information or fail to identify an attack. The consequences could ...

Network intrusion detection systems provide proactive defense against security threats by detecting and blocking attack-related traffic. This task can be highly complex, and therefore, software-based network intrusion detection systems have difficulty in handling high speed links. This paper describes the design and implementation of a highperformance network intrusion detection system that com...