A Literature Survey and Comprehensive Study of Intrusion Detection <s> INTRODUCTION <s> A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system. <s> BIB001 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> INTRODUCTION <s> This paper presents the preliminary architecture of a network level intrusion detection system. The proposed system will monitor base level information in network packets (source, destination, packet size, and time), learning the normal patterns and announcing anomalies as they occur. The goal of this research is to determine the applicability of current intrusion detection technology to the detection of network level intrusions. In particular, the authors are investigating the possibility of using this technology to detect and react to worm programs. <s> BIB002 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> INTRODUCTION <s> This report examines and classi es the characteristics of signatures used in misuse intrusion detection. E cient algorithms to match patterns in some of these classes are described. A generalized model for matching intrusion signatures based on Colored Petri Nets is presented, and some of its properties are derived. <s> BIB003 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> INTRODUCTION <s> Misuse detection is the process of attempting to identify instances of network attacks by comparing current activity against the expected actions of an intruder. Most current approaches to misuse detection involve the use of rule-based expert systems to identify indications of known attacks. However, these techniques are less successful in identifying attacks which vary from expected patterns. Artificial neural networks provide the potential to identify and classify network activity based on limited, incomplete, and nonlinear data sources. We present an approach to the process of misuse detection that utilizes the analytical strengths of neural networks, and we provide the results from our preliminary analysis of this approach. <s> BIB004 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> INTRODUCTION <s> There is often the need to update an installed intrusion detection system (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. We describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learning, association rules, and frequent episodes. We report on the results of applying these programs to the extensively gathered network audit data for the 1998 DARPA Intrusion Detection Evaluation Program. <s> BIB005 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> INTRODUCTION <s> Due to the increase in unauthorized access and stealing of internet resources, internet security has become a very significant issue. Network anomalies in particular can cause many potential problems, but it is difficult to discern these from normal traffic. In this paper, we focus on a Support Vector Machine (SVM) and a genetic algorithm to detect network anomalous attacks. We first use a genetic algorithm (GA) for choosing proper fields of traffic packets for analysis. Only the selected fields are used, and a time delay processing is applied to SVM for considering temporal relationships among packets. In order to verify our approach, we tested our proposal with the datasets of MIT Lincoln Lab, and then analyzed its performance. Our SVM approach with selected fields showed excellent performance. <s> BIB006 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> INTRODUCTION <s> In this paper, an improved version of ANNIDA for detecting attack signatures in the payload of network packets is presented. The Hamming Net artificial neural network methodology was used with good results. A review of the application's development is followed by a summary of the modifications made in the application in order to classify real data. Application improvements are reported, solving the problems of time delays in writing/reading data in the files and data collision effects when generating numeric keys used to model data for the neural network. Test results highlight the increased accuracy and efficiency of the new application when submitted to real data from HTTP network traffic containing actual traces of attacks and legitimate data. Finally, an evaluation of the application to detect signatures in real network traffic data is presented. <s> BIB007 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> INTRODUCTION <s> Fuzzy sets and fuzzy logic can be used for efficient data classification by fuzzy rules and fuzzy classifiers. This paper presents an application of genetic programming to the evolution of fuzzy classifiers based on extended Boolean queries. Extended Boolean queries are well known concept in the area of fuzzy information retrieval. An extended Boolean query represents a complex soft search expression that defines a fuzzy set on the collection of searched documents. We interpret the data mining task as a fuzzy information retrieval problem and we apply a proven method for query induction from data to find useful fuzzy classifiers. The ability of the genetic programming to evolve useful fuzzy classifiers is demonstrated on two use cases in which we detect faulty products in a product processing plant and discover intrusions in a computer network. <s> BIB008
By means of the extensive application of computer networks, the quantity of attacks has developed widely, and numerous hacking tools and intrusive methods have been appeared. Inside a network, one way of dealing with suspicious actions is by utilizing an intrusion detection system (IDS). By investigating different data records watched in processes on the network  [2] Intrusion detection attempts to detect computer attacks. To work out network security problems it is one of the essential ways. The two key signs to assess intrusion detection systems (IDS) BIB007 are Detection precision and detection stability. A lot of research has been done in order to improve the detection precision and detection stability. Commonly, Intrusion explained an act of encroaching or infringing the reliability, confidentiality or avoiding the accessibility of a resource BIB002 . Through internet, Intrusions Detection Systems discovers illegal or malicious assaults over a computer system which happens mainly. By the safety and hope of a system, these assaults can be compromised. To perceptive files, these harasses can acquire quite a few forms like network attack against vulnerable services, data driven attacks on applications, host based attacks such as privilege escalation, illegal logins and access. IDSs can be categorized as misuse detectors or anomaly detectors by sorting out broadly based on their models of detection. Mishandling detectors rely on understanding the models of known attacks BIB001 BIB003 , whereas irregularity detection develops user profiles as the basis of detection, and sorts the distinctiveness of the unexpected from the normal ones as incursion [5, 6, 7, and 8] . Conversely, the quantity and kinds of the intrusions increase radically as the speed and difficulty of networks expand quickly, particularly when these networks are unlock to the public Web. Therefore, it is becoming hard for any presented intrusion detection system to suggest a trustworthy repair with the varying technology and the exponential growth of Internet traffic it has been created that a behavioral model exists in the attacks that can be educated from former study. Various machine learning (ML) algorithms, such as Neural Network BIB004 , Support Vector Machine BIB006 , Genetic Algorithm  , Fuzzy Logic  BIB008 , and Data Mining BIB005 , etc have been broadly used to the huge volume of complex and active dataset to detect known and unknown intrusions so as to identify intrusion activities.