Neuro fuzzy based clustering of statistical anomaly traffic intrusion detection in combined wired and wireless networks

Abstract

The rapid advancement of communication technologies, particularly internet, brings numerous benefits to the users and it also increases their dependency on these technologies. Intrusion detection systems (IDS) have proved to be an effective instrument to protect networks. Intrusion detection systems are either signature-based or anomaly-based. Signature based approach seek defined patterns within the analyzed data. In this approach, a signature database corresponding to known attacks is specified earlier. Contrarily, anomaly-based detectors attempt to estimate the normal behavior of the system to be protected. The proposed work presented in this thesis based on statistical traffic anomaly detection is carried out on the main traces of traffic volume detection and verifies packet header format for its normal and abnormal anomaly traces. The objective is to identify and to cluster different alerts which are produced by low-level intrusion detection systems. Meta-alerts are generated for the clusters that contain all the relevant information. Meta-alerts are then reported to administrator or security experts. The proposed work is a dynamic, probabilistic model for online alert aggregation of the recent attack situation. Similar work is extended to the wireless networks. Since the growing need for internet using wireless LANs adapting IEEE 802.11 protocols becomes a major security concern and mixed attacks on the combined wired and wireless network cannot be identified by traditional attack detection model alone, combined Network Intrusion Detection Systems (NIDS) is developed. This model helps to generate anomaly intrusive and normal data packet clusters from the traffic data streams and ensures that every cluster comprises of its more appropriated cluster objects i.e. data packets on transition. The results show that the percentage of improvement is nearly 9% in terms of response time for the anomaly intrusion detection in the combined network traffic compared to enhanced k-means clustering algorithm. newline newline