A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> A novel multilevel hierarchical Kohonen Net (K-Map) for an intrusion detection system is presented. Each level of the hierarchical map is modeled as a simple winner-take-all K-Map. One significant advantage of this multilevel hierarchical K-Map is its computational efficiency. Unlike other statistical anomaly detection methods such as nearest neighbor approach, K-means clustering or probabilistic analysis that employ distance computation in the feature space to identify the outliers, our approach does not involve costly point-to-point computation in organizing the data into clusters. Another advantage is the reduced network size. We use the classification capability of the K-Map on selected dimensions of data set in detecting anomalies. Randomly selected subsets that contain both attacks and normal records from the KDD Cup 1999 benchmark data are used to train the hierarchical net. We use a confidence measure to label the clusters. Then we use the test set from the same KDD Cup 1999 benchmark to test the hierarchical net. We show that a hierarchical K-Map in which each layer operates on a small subset of the feature space is superior to a single-layer K-Map operating on the whole feature space in detecting a variety of attacks in terms of detection rate as well as false positive rate. <s> BIB001 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> As network attacks have increased in number and severity over the past few years, intrusion detection is increasingly becoming a critical component of secure information systems and supervised network intrusion detection has been an active and difficult research topic in the field of intrusion detection for many years. However, it hasn't been widely applied in practice due to some inherent issues. The most important reason is the difficulties in obtaining adequate attack data for the supervised classifiers to model the attack patterns, and the data acquisition task is always time-consuming and greatly relies on the domain experts. In this paper, we propose a novel supervised network intrusion detection method based on TCM-KNN (Transductive Confidence Machines for K-Nearest Neighbors) machine learning algorithm and active learning based training data selection method. It can effectively detect anomalies with high detection rate, low false positives under the circumstance of using much fewer selected data as well as selected features for training in comparison with the traditional supervised intrusion detection methods. A series of experimental results on the well-known KDD Cup 1999 data set demonstrate that the proposed method is more robust and effective than the state-of-the-art intrusion detection methods, as well as can be further optimized as discussed in this paper for real applications. <s> BIB002 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> Recently, research on intrusion detection in computer systems has received much attention to the computational intelligence society. Many intelligence learning algorithms applied to the huge volume of complex and dynamic dataset for the construction of efficient intrusion detection systems (IDSs). Despite of many advances that have been achieved in existing IDSs, there are still some difficulties, such as correct classification of large intrusion detection dataset, unbalanced detection accuracy in the high speed network traffic, and reduce false positives. This paper presents a new approach to the alert classification to reduce false positives in intrusion detection using improved self adaptive Bayesian algorithm (ISABA). The proposed approach applied to the security domain of anomaly based network intrusion detection, which correctly classifies different types of attacks of KDD99 benchmark dataset with high classification rates in short response time and reduce false positives using limited computational resources. <s> BIB003 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> Intrusion detection is an interesting approach that could be used to improve the security of network system. IDS detects suspected patterns of network traffic on the remaining open parts through monitoring user activities. The major problems of existing models is recognition of new attacks, low accuracy, detection time and system adaptability. In this paper, evolving anomaly intrusion detection system is constructed using hamming and MAXNET Neural Network for recognize attack class in the network traffic. The result is encouraging, the detection rate is 95% which is relatively high. We describe another approach based on Multilayer Perceptrons (MLP) network and compare the results of the two approaches to evaluate the system. The experimental results demonstrate that the designed models are promising in terms of accuracy and computational time of real word intrusion detection. Training and testing data obtains from the Defense Advanced Research Projects Agency(DARPA) intrusion detection evaluation datasets. <s> BIB004 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> Intrusion detection faces a number of challenges; an intrusion detection system must reliably detect malicious activities in a network and must perform efficiently to cope with the large amount of network traffic. In this paper, we address these two issues of Accuracy and Efficiency using Conditional Random Fields and Layered Approach. We demonstrate that high attack detection accuracy can be achieved by using Conditional Random Fields and high efficiency by implementing the Layered Approach. Experimental results on the benchmark KDD '99 intrusion data set show that our proposed system based on Layered Conditional Random Fields outperforms other well-known methods such as the decision trees and the naive Bayes. The improvement in attack detection accuracy is very high, particularly, for the U2R attacks (34.8 percent improvement) and the R2L attacks (34.5 percent improvement). Statistical Tests also demonstrate higher confidence in detection accuracy for our method. Finally, we show that our system is robust and is able to handle noisy data without compromising performance. <s> BIB005 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> Anomaly detection attempts to recognize abnormal behavior to detect intrusions. We have concentrated to design a prototype UNIX Anomaly Detection System. Neural Networks are tolerant of imprecise data and uncertain information. A tool has been devised for detecting such intrusions into the network. The tool uses the machine learning approaches ad clustering techniques like Self Organizing Map and compares it with the K-means approach. Our system is described for applying hierarchical unsupervised neural network to intrusion detection system. <s> BIB006 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> Many computational intelligence techniques for anomaly based network intrusion detection can be found in literature. Translating a newly discovered intrusion recognition criteria into a distributable rule can be a human intensive effort. This paper explores a multi-modal genetic algorithm solution for autonomous rule creation. This algorithm focuses on the process of creating rules once an intrusion has been identified, rather than the evolution of rules to provide a solution for intrusion detection. The algorithm was demonstrated on anomalous ICMP network packets (input) and Snort rules (output of the algorithm). Output rules were sorted according to a fitness value and any duplicates were removed. The experimental results on ten test cases demonstrated a 100 percent rule alert rate. Out of 33,804 test packets 3 produced false positives. Each test case produced a minimum of three rule variations that could be used as candidates for a production system. <s> BIB007 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> Machine learning techniques are frequently applied to intrusion detection problems in various ways such as to classify normal and intrusive activities or to mine interesting intrusion patterns. Self-learning rule-based systems can relieve domain experts from the difficult task of hand crafting signatures, in addition to providing intrusion classification capabilities. To this end, a genetic-based signature learning system has been developed that can adaptively and dynamically learn signatures of both normal and intrusive activities from the network traffic. In this paper, we extend the evaluation of our systems to real time network traffic which is captured from a university departmental server. A methodology is developed to build fully labelled intrusion detection data set by mixing real background traffic with attacks simulated in a controlled environment. Tools are developed to pre-process the raw network data into feature vector format suitable for a supervised learning classifier system and other related machine learning systems. The signature extraction system is then applied to this data set and the results are discussed. We show that even simple feature sets can help detecting payload-based attacks. <s> BIB008 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Suseela T et al have presented a multilevel hierarchical <s> In this paper intrusion detection using Bayesian probability is discussed. The systems designed are trained a priori using a subset of the KDD dataset. The trained classifier is then tested using a larger subset of KDD dataset. Initially, a system was developed using a naive Bayesian classifier that is used to identify possible intrusions. This classifier was able to detect intrusion with an acceptable detection rate. The classier was then extended to a multi-layer Bayesian based intrusion detection. Finally, we introduce the concept that the best possible intrusion detection system is a layered approach using different techniques in each layer. <s> BIB009
Kohonen Net (K-Map) BIB001 for an intrusion detection system in 2005. Every level of the hierarchical map was modeled as a straightforward winner-take-all K-Map. The computational effectiveness is the major advantage of this multilevel hierarchical K-Map. Statistical anomaly detection methods such as nearest neighbor approach, K-means clustering or probabilistic analysis that employed distance computation in the feature space to identify the outliers. However this multilevel hierarchical K-Map's approach does not engage expensive point-to-point computation in grouping the data into clusters. The reduced network size is an additional advantage. The categorization potential of the K-Map on chosen dimensions of data was used to set for detecting anomalies. Sub-sets selected aimlessly that enclose both attacks and normal records from the KDD Cup 1999 benchmark data were used to guide the hierarchical net. In 2007, an evolutionary soft computing approach for intrusion has been commenced by Adel Nadjaran Toosi and Mohsen Kahani  and was effectively explained its utility on the training and testing subset of KDD Cup 99 dataset. For interference detection, the ANFIS network was utilized as a neuro-fuzzy classifier. Without the help of human experts ANFIS was talented of generating fuzzy rules. Furthermore, to find out the number of rules and membership functions with their initial locations for enhanced classification subtractive clustering had been used. To create the system more prevailing for attack detection using the fuzzy inference approach, a fuzzy decision-making engine was built up. In the end, they planned a system to utilize genetic algorithms to optimize the fuzzy decision-making engine. The planned system was successful in discovering various intrusions in BIB002 . It was successfully identified anomalies with elevated detection rate, low false positives under the condition of utilizing much less chosen data as well as selected features for training in association with the traditional managed intrusion detection techniques. The recommended method was more tough and successful than the state-of-the-art intrusion detection methods which were explained by a chain of experimental results on the familiar KDD Cup 1999 data set. In advance to the above concept in the year 2009, a network based anomaly detection system that makes use of a hierarchy of SOMs has been offered by Saroj Kumar Panigrahy et al. BIB006 . By means of a controllable rate of false alarms the system was set up to identify very soon over 60% of the attacks. Even though the result of this job was construed with warning, it was recommended that the arrangement offered carry out comparably to few of the superior systems that took part in the DARPA Intrusion Detection Evaluation. The system was also not at all trained on the complete training dataset, sense that it could not have had a opening to learn the full sort of usual behavior and it was not tested on the full test dataset, i.e., it may not have come across few of the more not easy attacks. In development of the above concept in the year 2010 by means of enhanced self adaptive Bayesian algorithm (ISABA), an approach to the vigilant classification to lessen false positives in intrusion detection has been offered by Dewan Md. Farid and Mohammad Zahidur Rahman BIB003 . The recommended approach used to the security domain of anomaly based network intrusion detection, which properly categorized dissimilar types of attacks of KDD99 benchmark dataset with elevated arrangement rates in small reply time and decrease false positives with restricted computational assets. In 2010, an intrusion detection system was constructed by Muna M. Taher Jawhar and Monica Mehrotra BIB004 using hamming and MAXNET Neural Network for recognizing attack class in the network traffic. One more approach based on Multilayer Perceptrons (MLP) network has been derived and the evaluation of the system is done by comparing the results of the two approaches. The results of experiments confirmed that the designed models were capable in terms of accuracy and computational time of real word intrusion detection. Defense Advanced Research Projects Agency (DARPA) intrusion detection evaluation datasets provided the necessary training and testing data. The utilization of Self Organizing Maps for building an Intrusion Detection System is well described by Mr. Vivek A. Patole et al.  in the same year. The system architecture and the flow diagram for the SOM have been explained. The advantages and disadvantages of the algorithm have also been presented. Their real experiments proved that even a simple map, when trained on usual data, could detect the anomalous features of both buffer overflow intrusions to which they are exposed. Also, an interference detection system with Bayesian probability has been developed by Hesham Altwaijry and Saeed Algarny BIB009 . To categorize possible intrusions, the structure developed was an adolescent Bayesian classifier that was utilized. The structure was taught a priori by means of a subset of the KDD dataset. The capability of Bayesian classifier was to distinguish the interference with a better detection rate. With Conditional Random Fields and Layered Approach, Kapil Kumar Gupta et al. BIB005 had lectured two topics of Accuracy and Efficiency. They revealed high attack detection precision was obtained by means of Conditional Random Fields and high competence by applying the Layered Approach. Their recommended system based on Layered Conditional Random Fields outperforms other familiar means such as the decision trees and the naive Bayes was shown by the experimental results on the benchmark KDD '99 intrusion data set. Detection accuracy for our method is confirmed by statistical Tests which induced higher confidence level. In conclusion, it has been shown that the system was healthy and is capable of handling noisy data with no compromise on performance. In development to the above approach in the year 2011, for independent rule creation, a multi-modal genetic algorithm solution has been discovered by Todd Vollmer et al. BIB007 . Relatively than the development of rules to give a solution for interference detection this algorithm spotlight on the process of making rules once interference had been recognized. The algorithm was explained on irregular ICMP network packets (input) and Snort rules (output of the algorithm). According to a fitness value output rules were arranged and any replacements were detached. These rules were precise to the packets and formed only four false positives from 33,804 test packets that were shown by testing. In advance to the above technique in 2011, different ways such as to categorize normal and intrusive actions or to extract interesting intrusion models, Machine learning techniques are often used to interference detection problems. Besides providing interference classification capacities self learning rule-based systems can ease area specialists from the complicated task of hand crafting signatures. A genetic-based signature knowledge system that was adaptively and energetically learns signatures of both standard and interfering actions from the network traffic has been developed by Kamran Shafi, Hussein A. Abbass BIB008 to this end. The assessment of their systems to actual time network traffic which was incarcerated from a university departmental server was completed by them. By combining real background traffic with attacks replicated in a controlled environment an attitude was developed to put together fully labeled interference detection data set. Proper for a managed learning classifier system and other associated machine learning systems apparatus were improved to preprocess the unrefined network data into quality vector format. The signature extraction system was then pertained to this data set