A Review of Anomaly based Intrusion Detection Systems <s> INTRODUCTION <s> Network intrusion detection systems (NIDS) are an important part of any network security architecture. They provide a layer of defense which monitors network traffic for predefined suspicious activity or patterns, and alert system administrators when potential hostile traffic is detected. Commercial NIDS have many differences, but Information Systems departments must face the commonalities that they share such as significant system footprint, complex deployment and high monetary cost. Snort was designed to address these issues. <s> BIB001 </s> A Review of Anomaly based Intrusion Detection Systems <s> INTRODUCTION <s> We present Poseidon, a new anomaly based intrusion detection system. Poseidon is payload-based, and presents a two-tier architecture: the first stage consists of a Self-Organizing Map, while the second one is a modified PAYL system. Our benchmarks on the 1999 DARPA data set show a higher detection rate and lower number of false positives than PAYL and PHAD. <s> BIB002 </s> A Review of Anomaly based Intrusion Detection Systems <s> INTRODUCTION <s> Abs tract: The huge expansi on in the si ze of internet and the appearance of various types of malicious attack and the in s u fficiency of traditional security tools like antivirus conduct to the development of intrusion detection systems or IDS. Since current IDSs are s ignature based they stil are unable to detect new forms of attacks even if these attacks are slightly deriv e d from known ones. So, recent researches concentrate on developing new techniques, algorithms and IDSs that use inteligent methods. In this paper som e anomaly detection engines have been propos e d based on K-NN, K-Means Clus tering (KM C) algo rithms . Firs tly, by applying information theory meas ures , network connection features were ranked according to the ir importance in detecting attack clas se s like DOS, R2L, U2R, and PROBE. This ranking strongl y helped in sel ecting only the most important features and by cons equent decreas ing dramaticaly the computation complexit y and eliminating the nois e res ultant of irrelevant features. Secondly, som e anomaly Intrusi on D etection models approaches were propo s e d depending on features s election, k-N N an d k-means clust ering. Thes e approaches proved their efficiency, where the detection rate was more than 92% and was better than other approaches es pecialy in detecting dangerous attacks like R2L and U2R. <s> BIB003
Network intrusion detection systems (NIDS) are most efficient way of defending against network-based attacks aimed at computer systems   . These systems are used in almost all large-scale IT infrastructures  . Basically, there are two main types of intrusion detection systems: signature-based (SBS) and anomaly-based (ABS). SBS systems (e.g. Snort BIB001 BIB003 ) rely on pattern recognition techniques where they maintain the database of signatures of previously known attacks and compare them with analyzed data. An alarm is raised when the signatures are matched. On the other hand ABS systems (e.g. PAYL  ) build a statistical model describing the normal network traffic, and any abnormal behavior that deviates from the model is identified. In contrast to signature-based systems, anomaly-based systems have the advantage that they can detect zero-day attacks, since novel attacks can be detected as soon as they take place. Whereas ABS (unlike SBS) requires a training phase to develop the database of general attacks and a careful setting of threshold level of detection makes it complex. In this paper focus is on anomaly-based systems, in particular on a specific kind of this ABS payload-based. These payload-based systems are particularly suitable to detect advanced attacks, and we describe the most prominent and the most recent of them in detail: respectively Wang and Stolfo"s PAYL  and our POSEIDON BIB002 .