Study and analysis of network intrusion detection system by designing rule based filter

Abstract

The world is linked and interconnected by means of computer networks in various extents of processes, events and applications. The networks must be scalable to support increasing number of users and there is a need for greater capacity and performance. In this circumstance, every part of the operation should carefully maintain the systems in an excellent phase of security. In general, the kind of users and the injection of network packets into the internet sectors are not under specific control. The security and effectiveness of a wired and wireless network system are compromised due to intrusion. An intruder attempts to gain doorway access to a system or disturb the normal operations. The literatures in the area of incidental response deal with the detection, reaction, prevention and correction. Intrusion reaction should limit the loss due to invasion and trigger measures to return to normal state as early as possible. Intrusion correction concludes the reinstatement of operations and makes necessary actions in order to prevent similar attack eventually. This thesis focuses on detection of both attack and normal traffics by analyzing the signatures of the data packet taken from the KDD Cup99 data. The bench mark intrusion detection features are constructed by observing the traffic over a time window and are made available in KDD Cup99 data. In this thesis, the constructed features are used for clustering the traffic by working out the statistical distribution and by attaching a label to the cluster for further classification. Then Adaboost based classification is made using neural network as weak classification. There are varieties of types such as continuous and discrete those are available in the intrusion detection features. Also, due to the high state space complements with these features, the pattern recognition techniques do not yield good classification results. Thus, rule based intrusion detection is proposed in this thesis and the results obtained are promising.