A Review of Anomaly based Intrusion Detection Systems <s> CURRENT STATE OF ART <s> In this work we introduce the idea of using behavioral biometrics in intrusion detection applications. We propose a new approach to user profiling, which can be used to detect intrusion without the need for any special hardware implementation and without forcing the user to perform any special actions. The technique is based on using "keystroke dynamics" and "mouse dynamics" biometrics. The profiles computed in this case are more accurate than those obtained through the traditional statistical profiling techniques, since they are based on distinctive biological characteristics of users. <s> BIB001 </s> A Review of Anomaly based Intrusion Detection Systems <s> CURRENT STATE OF ART <s> Anomaly detection is a critical issue in Network Intrusion Detection Systems (NIDSs). Most anomaly based NIDSs employ supervised algorithms, whose performances highly depend on attack-free training data. However, this kind of training data is difficult to obtain in real world network environment. Moreover, with changing network environment or services, patterns of normal traffic will be changed. This leads to high false positive rate of supervised NIDSs. Unsupervised outlier detection can overcome the drawbacks of supervised anomaly detection. Therefore, we apply one of the efficient data mining algorithms called random forests algorithm in anomaly based NIDSs. Without attack-free training data, random forests algorithm can detect outliers in datasets of network traffic. In this paper, we discuss our framework of anomaly based network intrusion detection. In the framework, patterns of network services are built by random forests algorithm over traffic data. Intrusions are detected by determining outliers related to the built patterns. We present the modification on the outlier detection algorithm of random forests. We also report our experimental results over the KDD'99 dataset. The results show that the proposed approach is comparable to previously reported unsupervised anomaly detection approaches evaluated over the KDD' 99 dataset. <s> BIB002 </s> A Review of Anomaly based Intrusion Detection Systems <s> CURRENT STATE OF ART <s> We propose lightweight methods to detect anomaly intrusions in wireless sensor networks (WSNs). The main idea is to reuse the already available system information that is generated at various layers of a network stack. To the best of our knowledge, this is the first such approach for anomaly intrusion detection in WSNs. <s> BIB003 </s> A Review of Anomaly based Intrusion Detection Systems <s> CURRENT STATE OF ART <s> In this paper we proposed Hierarchical Gaussian Mixture Model (HGMM) a novel type of Gaussian Mixture which detects network based attacks as anomalies using statistical preprocessing classification. This method learns patterns of normal and intrusive activities to classify that use a set of Gaussian probability distribution functions. The use of Maximum likelihood in detection phase has used the deviation between current and reference behavior. HGMM is evaluated by dataset KDD99 without any special hardware requirements. We compare it with six classification techniques; Gaussian Mixture, Radial Basis Function, Binary Tree Classifier, SOM, ART and LAMSTAR to verify its feasibility and effectiveness. Experimental results show that this method is able to reducing the missing alarm, and can accurately predict probable attack behavior in IDS. <s> BIB004 </s> A Review of Anomaly based Intrusion Detection Systems <s> CURRENT STATE OF ART <s> Abs tract: The huge expansi on in the si ze of internet and the appearance of various types of malicious attack and the in s u fficiency of traditional security tools like antivirus conduct to the development of intrusion detection systems or IDS. Since current IDSs are s ignature based they stil are unable to detect new forms of attacks even if these attacks are slightly deriv e d from known ones. So, recent researches concentrate on developing new techniques, algorithms and IDSs that use inteligent methods. In this paper som e anomaly detection engines have been propos e d based on K-NN, K-Means Clus tering (KM C) algo rithms . Firs tly, by applying information theory meas ures , network connection features were ranked according to the ir importance in detecting attack clas se s like DOS, R2L, U2R, and PROBE. This ranking strongl y helped in sel ecting only the most important features and by cons equent decreas ing dramaticaly the computation complexit y and eliminating the nois e res ultant of irrelevant features. Secondly, som e anomaly Intrusi on D etection models approaches were propo s e d depending on features s election, k-N N an d k-means clust ering. Thes e approaches proved their efficiency, where the detection rate was more than 92% and was better than other approaches es pecialy in detecting dangerous attacks like R2L and U2R. <s> BIB005
A new method that could achieve more accuracy than the existing six classification patterns (Gaussian Mixture, Radial Basis Function, Binary Tree Classifier, SOM, ART and LAMASTAR),called Hierarchical Gaussian Mixture Model[HMM] for IDM was put forward by M.Bahrololum et al BIB004 . Jiankun Hu and Xinghuo Yu et al  studied development of host-based anomaly intrusion detection, focusing on system call based HMM training. This was later enhanced with the inclusion of data pre-processing for recognizing and eliminating redundant sub-sequences of system calls, resulting in less number of HMM sub models. Experimental results on three public databases indicated that training cost can be reduced by 50% without affecting the intrusion detection performance. False alarm rate is higher yet reasonable compared to the batch training method with a 58% data reduction. R. Nakkeeran et al  proposed an anomaly detection system comprising of detection modules for detecting anomalies in each layer. The anomaly detection result of the neighbor node(s) is taken by the current node and its result in turn is sent to the neighbor node(s).Experimental results revealed increased detection rate and reduced false alarm positives, compared to other methods. Jiong Zhang et al BIB002 proposed a new framework of unsupervised anomaly NIDS based on the outlier detection technique in random forests algorithm. The framework builds the patterns of network services over datasets labeled by the services. With the built patterns, the framework detects attacks in the datasets using the modified outlier detection algorithm, reducing the calculation complexity. This approach is independent of attack-free training datasets, but assumes that each network service has its own pattern for normal activities. Ahmed Awad E. Ahmed et al BIB001 proposed a biometrics-based intrusion detector model to provide a lightweight and selfcontained module for detecting user identities misuse. System-calls and network traffic monitoring systems have to be combined to this detector to achieve the best solutions. Vijay Bhuse et al BIB003 proposed a technique to detect anomalies at all layers of a network stack in a sensor network, segregating the service at various levels. Physical layer intrusion is detected by using RSSI values of neighbors (dependant on background noise, weather conditions etc). Targeting MAC layer will work for schedule based and sleep/wake-up based MAC protocols while IASN protocol is aimed at the routing layer. Experiments show that IASN can be used for source initiated routing protocols, table driven routing protocols and data dissemination mechanisms like directed diffusion. The probability of detection increases linearly with the number of nodes running IASN. Nodes guard each other from masquerade at application layer. Depending on the resource availability, any combination of the above methods can be employed, as they are independent of one another. All techniques are energy efficient as they have very low false positive rates(except RSSI and round trip time) and low overhead. Using information theory measures, a model was put forward by Hossein M. Shirazi et al BIB005 that ranked 41 connection features performing normalization on each attack class. The main features of this are, ranking (relevant features for each attack class are selected and computing complexity is decreased) and features-selection (detection rate preserved, yet detection time decreased). Noisy and irrelevant features can be eliminated by running some detection models like SF-5NN and SUS-5NN using only selected features. A combination of two detection engines( SF-KNN,SUS-KNN) based on best selected features and K-NN algorithm was proposed, that was much better(notably in detecting attacks like U2R, R2L) than approaches like traditional 5-NN, C4.5,C5. Experimentally, engines gave classification rates of 92.56%, 92.84% and false positive rates 2% and 4.52% respectively. Dayu Yang et al  introduced a method to apply Auto Associative Kernel Regression (AAKR) empirical modeling and the SPRT for SCADA system intrusion detection. In detecting anomalous behavior, this model is limited by two requirements -different indicators for different intrusion methods and managing a number of highly valuable variables. Identifying the optimal set of indicators for known and potential abnormalities is the future of this research.