doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Conclusions on DoS Detection <s> The capacity to learn from examples is one of the most desirable features of neural network models. We present a learning algorithm for the recurrent random network model (Gelenbe 1989, 1990) using gradient descent of a quadratic error function. The analytical properties of the model lead to a "backpropagation" type algorithm that requires the solution of a system of n linear and n nonlinear equations each time the n-neuron network "learns" a new input-output pair. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Conclusions on DoS Detection <s> The security of computer networks plays a strategic role in modern computer systems. In order to enforce high protection levels against threats, a number of software tools have been currently developed. Intrusion Detection Systems aim at detecting intruders who elude "first line" protection. In this paper, a pattern recognition approach to network intrusion detection based on the fusion of multiple classifiers is proposed. Five decision fusion methods are assessed by experiments and their performances compared. The potentialities of classifier fusion for the development of effective intrusion detection systems are evaluated and discussed. <s> BIB002 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Conclusions on DoS Detection <s> In our present work we introduce the use of data fusion in the field of DoS anomaly detection. We present Dempster-Shafer's Theory of Evidence (D-S) as the mathematical foundation for the development of a novel DoS detection engine. Based on a data fusion paradigm, we combine multiple evidence generated from simple heuristics to feed our D-S inference engine and attempt to detect flooding attacks.Our approach has as its main advantages the modeling power of Theory of Evidence in expressing beliefs in some hypotheses, the ability to add the notions of uncertainty and ignorance in the system and the quantitative measurement of the belief and plausibility in our detection results.We evaluate our detection engine prototype through a set of experiments, that were conducted with real network traffic and with the use of common DDoS tools. We conclude that data fusion is a promising approach that could increase the DoS detection rate and decrease the false alarm rate. <s> BIB003 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Conclusions on DoS Detection <s> Soft computing techniques are increasingly being used for problem solving. This paper addresses using an ensemble approach of different soft computing and hard computing techniques for intrusion detection. Due to increasing incidents of cyber attacks, building effective intrusion detection systems are essential for protecting information systems security, and yet it remains an elusive goal and a great challenge. We studied the performance of Artificial Neural Networks (ANNs), Support Vector Machines (SVMs) and Multivariate Adaptive Regression Splines (MARS). We show that an ensemble of ANNs, SVMs and MARS is superior to individual approaches for intrusion detection in terms of classification accuracy. <s> BIB004 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Conclusions on DoS Detection <s> The network security problem has become a critical issue and many approaches have been proposed to tackle the information security problems, especially the Denial of Service (DoS) attacks. Multiple Classifier System (MCS) is one of the approaches that have been adopted in the detection of DoS attacks recently. Fusion strategy is crucial and has great impact on the classification performance of an MCS. However the selection of the fusion strategy for an MCS in DoS problem varies widely. In this paper, we focus on the comparative study on adopting different fusion strategies for an MCS in DoS problem. <s> BIB005
This survey indicates that an overall DoS detection mechanism will have to pragmatically combine different detectors in order to provide robust and effective detection, especially as attack methods and schemes evolve and are improved. Initial steps in this direction can be found in some of the work that we have surveyed. In BIB004 BIB005 , the outputs of intelligent decision units are combined to detect a DoS attack, while in BIB002 , information about the data content of packets, and the past and present connection statistics are fused. In BIB003 , information measured from different sensors is combined using the Dempster-Shafer Theory of evidence, and in  multiple features are fused using a random neural network BIB001 for DoS detection.