Current network security tools generally lack sufficient context for maintaining a well informed and proactive defense posture. Vulnerabilities are usually assessed in isolation, without considering how they contribute to overall attack risk. Similarly, intrusion alarms are logged as isolated events, with limited correlation capabilities. Security professionals are overwhelmed by constant threa...

The article introduced the importance of intrusion detection, as well as the traditional intrusion detection's type and the limitation. Also, according to the intrusion detection's general process and data mining characteristic, it establishes a data mining-based model of network intrusion detection which is designed for its flaw. As a result, the missing report reduces greatly; the examination...

We have set up a project aiming at developing a dynamical immune intrusion detection system for IPv6 and protecting the next generation Internet from intrusion. We focus on investigating immunological principles in designing a dynamic multi-agent system for intrusion detection in IPv6 environment, instead of attempting to describe all that is intrusion in the network try and describe what is no...

Network-based intrusion has become a serious threat to today’s highly networked information systems, existing intrusion defense approaches such as intrusion prevention, detection, tolerance and response are “passive” in response to network-based intrusions in that their countermeasures are limited to being local to the intrusion target and there is no automated, network-wide counteraction again...

An important goal of the 1999 DARPA Intrusion Detection Evaluation was to promote the development of intrusion detection systems that can detect new attacks. This thesis describes UNIX attacks developed for the 1999 DARPA Evaluation. Some attacks were new in 1999 and others were stealthy versions of 1998 User-to-Root attacks designed to evade network-based intrusion detection systems. In additi...

The network intrusion detection problem is the focus of current academic research. In this paper, we propose to use Support Vector Machine (SVM) model to identify and detect the network intrusion problem, and simultaneously introduce a new optimization search method, referred to as Improved Harmony Search (IHS) algorithm, to determine the parameters of the SVM model for better classification ac...

Nowadays, completely protect a network from attacks is being a very hard task. Even heavily protected networks are sometimes penetrated, and an Intrusion Detection System (IDS) seems to be essential and is a key component in computer and network security. Several researchers worked on comparison between Bayesian Network (BN) and Possibilistic network (PN). But, in this paper we are interested b...

Intrusion detection systems (IDSs) are currently drawing a great amount of interest as a key part of system defence. IDSs collect network traffic information from some point on the network or computer system and then use this information to secure the network. Recently, machine learning methodologies are playing an important role in detecting network intrusions (or attacks), which further helps...

A low-effort data mining approach to labeling network event records in a WLAN is proposed. The problem being addressed is often observed in an AI and data mining strategy to network intrusion detection, i.e., need for a training dataset of network event records that are labeled as either normal or an intrusion type. Given the dynamic nature of intrusion detection, such a dataset is often very l...

An intrusion detection system (IDS) is a device or application that monitors all Host based IDS refers to intrusion detection that takes place on a single host. Host-based Intrusion Detection System (HIDS) and File Integrity Monitoring (FIM) policy violations, vulnerable software, or suspicious communications. An IDS can be a piece of installed software or a physical appliance Host intrusion de...