A Literature Survey and Comprehensive Study of Intrusion Detection <s> International Journal of Computer Applications (0975 -8887) Volume 81 -No 16, November 2013 <s> This paper introduces a hybrid scheme that combines the advantages of deep belief network and support vector machine. An application of intrusion detection imaging has been chosen and hybridization scheme have been applied to see their ability and accuracy to classify the intrusion into two outcomes: normal or attack, and the attacks fall into four classes; R2L, DoS, U2R, and Probing. First, we utilize deep belief network to reduct the dimensionality of the feature sets. This is followed by a support vector machine to classify the intrusion into five outcome; Normal, R2L, DoS, U2R, and Probing. To evaluate the performance of our approach, we present tests on NSL-KDD dataset and show that the overall accuracy offered by the employed approach is high. <s> BIB001 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> International Journal of Computer Applications (0975 -8887) Volume 81 -No 16, November 2013 <s> This paper investigates the possibility of using ensemble algorithms to improve the performance of network intrusion detection systems. We use an ensemble of three different methods, bagging, boosting and stacking, in order to improve the accuracy and reduce the false positive rate. We use four different data mining algorithms, naive bayes, J48 (decision tree), JRip (rule induction) and iBK( nearest neighbour), as base classifiers for those ensemble methods. Our experiment shows that the prototype which implements four base classifiers and three ensemble algorithms achieves an accuracy of more than 99% in detecting known intrusions, but failed to detect novel intrusions with the accuracy rates of around just 60%. The use of bagging, boosting and stacking is unable to significantly improve the accuracy. Stacking is the only method that was able to reduce the false positive rate by a significantly high amount (46.84%); unfortunately, this method has the longest execution time and so is inefficient to implement in the intrusion detection field. <s> BIB002 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> International Journal of Computer Applications (0975 -8887) Volume 81 -No 16, November 2013 <s> This paper describes the advantages of using the anomaly detection approach over the misuse detection technique in detecting unknown network intrusions or attacks. It also investigates the performance of various clustering algorithms when applied to anomaly detection. Five different clustering algorithms: k-Means, improved k-Means, k-Medoids, EM clustering and distance-based outlier detection algorithms are used. Our experiment shows that misuse detection techniques, which implemented four different classifiers (naive Bayes, rule induction, decision tree and nearest neighbour) failed to detect network traffic, which contained a large number of unknown intrusions; where the highest accuracy was only 63.97% and the lowest false positive rate was 17.90%. On the other hand, the anomaly detection module showed promising results where the distance-based outlier detection algorithm outperformed other algorithms with an accuracy of 80.15%. The accuracy for EM clustering was 78.06%, for k-Medoids it was 76.71%, for improved k-Means it was 65.40% and for k-Means it was 57.81%. Unfortunately, our anomaly detection module produces high false positive rate (more than 20%) for all four clustering algorithms. Therefore, our future work will be more focus in reducing the false positive rate and improving the accuracy using more advance machine learning techniques. <s> BIB003 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> International Journal of Computer Applications (0975 -8887) Volume 81 -No 16, November 2013 <s> This work-in-progress paper presents an ensemble-based model for detecting and mitigating Distributed Denial-of-Service (DDoS) attacks, and its partial implementation. The model utilises network traffic analysis and MIB (Management Information Base) server load analysis features for detecting a wide range of network and application layer DDoS attacks and distinguishing them from Flash Events. The proposed model will be evaluated against realistic synthetic network traffic generated using a software-based traffic generator that we have developed as part of this research. In this paper, we summarise our previous work, highlight the current work being undertaken along with preliminary results obtained and outline the future directions of our work. <s> BIB004 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> International Journal of Computer Applications (0975 -8887) Volume 81 -No 16, November 2013 <s> With exponential growth in the number of computer applications and the size of networks, the potential damage that can be caused by attacks launched over the internet keeps increasing dramatically. A number of network intrusion detection methods have been developed with their respective strengths and weaknesses. The majority of research in the area of network intrusion detection is still based on the simulated datasets because of non-availability of real datasets. A simulated dataset cannot represent the real network intrusion scenario. It is important to generate real and timely datasets to ensure accurate and consistent evaluation of methods. We propose a new real dataset to ameliorate this crucial shortcoming. We have set up a testbed to launch network traffic of both attack as well as normal nature using attack tools. We capture the network traffic in packet and flow format. The captured traffic is filtered and preprocessed to generate a featured dataset. The dataset is made available for research purpose. <s> BIB005
respectively  . The used method for attack training was the mixture of unsupervised and supervised Neural Network (NN) for Intrusion Detection System. Attacks was categorized into smaller categories taking into consideration their similar features by the unsupervised NN based on Self Organizing Map (SOM), and followed by unsupervised NN based on Back propagation was utilized for grouping. Known packets were recognized fast by misuse approach and unknown attacks will be able to spot by this method. three techniques containing two machine-learning paradigms has been built up [24] . In order to organize an effective intrusion detection system, K-Means Clustering, Fuzzy Logics and Neural Network techniques were arranged. The existence of high rate of false alerts makes unnecessary interference of human analyst even out of the numerous problems in the traditional techniques of Intrusion Detection Systems. To differentiate the nature of such alerts and commence sufficient actions, the human analysts in turn carry out a serious analysis continually. In order to remove the unnecessary interference of human analyst in such events, the approach offered exposed the advantage of converging K-Means-Fuzzy-Neuro techniques. The technique was examined using mass of background knowledge sets in DARPA network traffic datasets. The experimental results leave outstanding development in reducing the false alarms as well to increased capacity to confine intrusion packets that were no alike to the ones in the training datasets. In the year 2010, to work out the problem and aid IDS get higher detection rate, less false positive rate and stronger constancy based on ANN and fuzzy clustering an approach, named FC-ANN has been offered by Gang Wang et al. [25] . The common process of FC-ANN was as follows: initially fuzzy clustering system was utilized to produce dissimilar training subsets. Based on different training subsets, dissimilar ANN models were educated to put together different base models consequently. At last, to summative those results a meta-learner, fuzzy aggregation module, were utilized. Investigational results on the KDD CUP 1999 dataset proved that their offered approach, FC-ANN, outperforms BPNN and other famous methods such as decision tree, the naïve Bayes in terms of detection accuracy and finding constancy. In the very next year, a hybrid plan that united the advantages of deep belief network and support vector machine has been brought in by Mostafa A et al. BIB001 . Hybridization plan has been related and a submission of interference detection imaging had been selected to see their capability and correctness to categorize the interference into two products: normal or attack, and the attacks fall into four classes; R2L, DoS, U2R, and Probing. In order to cut the dimensionality of the feature sets they employed deep belief network at first. This was pursued by a support vector machine to categorize the interference into five product; Normal, R2L, DoS, U2R, and Probing. Tests on NSL-KDD dataset were offered by them to assess the performance of their approach and demonstrated that the on the whole accuracy proposed by the utilized approach was high. In 2012, An Advancement in the performance of network intrusion detection systems has been investigated to find out the possibility by means of assembling algorithms by Iwan Syarif et al. BIB002 . An ensemble of three different methods such as bagging, boosting and stacking was used with the purpose of improving the accuracy and reducing the false positive rate. A variety of four different data mining algorithms, naïve bayes, J48 (decision tree), JRip (rule induction) and iBK (nearest neighbour) were used as base classifiers for those ensemble methods. Their experiment proved that the prototype which activates four base classifiers and three ensemble algorithms achieves in detecting known intrusions, but it has been unsuccessful in detecting intrusions with the accuracy rates. Considerably improvement in the accuracy is not able to be reached by the usage of bagging, boosting and stacking. A hybrid clever approach using combination of classifiers so as to formulate the result wisely has been presented in the same year by Mrutyunjaya Panda et al.  . This method enabled the overall performance of the resultant model. The supervised or un-supervised data filtering with classifier or cluster first on the whole training dataset is followed and then the output was given to another classifier to classify the data. This was the common practice. 2-class classification approach along with 10-fold cross validation method is used to produce the final classification results in conditions of normal or else intrusion. Their proposed method was competent by way of high detection rate and low false alarm rate. This was proved by the results of experiments on NSL-KDD dataset which is an improved version of KDDCup 1999 dataset. and the results were argued. Detecting payload based attacks they illustrated that even easy feature sets were assisted. In the very next year in 2012, Iwan Syarif et al. BIB003 have illustrated the compensation of utilizing the variance detection approach over the mishandling detection technique in detecting unknown network intrusions or attacks. When applied to anomaly detection it also examined the presentation of different grouping algorithms. We have five different clustering algorithms: k-Means, improved k-Means, k-Medoids, EM clustering and distance-based outlier detection algorithms were utilized. Their testing showed that mishandling detection techniques, which executed four dissimilar classifiers (naïve Bayes, rule induction, decision tree and nearest neighbor) unsuccessful to detect network traffic, which enclosed a large number of unknown interferences. In the same year in 2012, an intangible model for identifying and mitigating Distributed Denial-of-Service (DDoS) attacks and its incomplete achievement has been offered by Sajal Bhatia et al. BIB004 . To identify DDoS attacks, to distinguish them from like looking FEs, and to bring about source IP based mitigation strategies upon attack identification an assembly of network traffic and MIB server load data analysis was used in the mold. The testing and presentation assessment of the suggested model was performed by means of artificial network traffic, intimately on behalf of real-world DDoS attacks and FE traffic, a produced using a software-based traffic generator developed. Prasanta Gogoi et al. BIB005 have suggested an actual dataset to modernize this critical inadequacy. A test bed has been set up by them to begin network traffic of both attack as well as standard nature by means of attack tools. The network traffic in sachet and flow format was incarcerated by them. To produce a featured dataset the incarcerated traffic was sorted out and preprocessed. For investigate purpose the dataset was made accessible. They have High-level study of the KDD Cup 1999 and NSL-KDD datasets which are offered by them. Detection rate and false alarm rate are considered for comprehensive analysis.