Tags

Type your tag names separated by a space and hit enter

An automatically tuning intrusion detection system.
IEEE Trans Syst Man Cybern B Cybern. 2007 Apr; 37(2):373-84.IT

Abstract

An intrusion detection system (IDS) is a security layer used to detect ongoing intrusive activities in information systems. Traditionally, intrusion detection relies on extensive knowledge of security experts, in particular, on their familiarity with the computer system to be protected. To reduce this dependence, various data-mining and machine learning techniques have been deployed for intrusion detection. An IDS is usually working in a dynamically changing environment, which forces continuous tuning of the intrusion detection model, in order to maintain sufficient performance. The manual tuning process required by current systems depends on the system operators in working out the tuning solution and in integrating it into the detection model. In this paper, an automatically tuning IDS (ATIDS) is presented. The proposed system will automatically tune the detection model on-the-fly according to the feedback provided by the system operator when false predictions are encountered. The system is evaluated using the KDDCup'99 intrusion detection dataset. Experimental results show that the system achieves up to 35% improvement in terms of misclassification cost when compared with a system lacking the tuning feature. If only 10% false predictions are used to tune the model, the system still achieves about 30% improvement. Moreover, when tuning is not delayed too long, the system can achieve about 20% improvement, with only 1.3% of the false predictions used to tune the model. The results of the experiments show that a practical system can be built based on ATIDS: system operators can focus on verification of predictions with low confidence, as only those predictions determined to be false will be used to tune the detection model.

Authors+Show Affiliations

Department of Computer Science, University of Illinois at Chicago, Chicago, IL 60607, USA. zyu@cs.uic.eduNo affiliation info availableNo affiliation info available

Pub Type(s)

Evaluation Study
Journal Article
Research Support, Non-U.S. Gov't

Language

eng

PubMed ID

17416165

Citation

Yu, Zhenwei, et al. "An Automatically Tuning Intrusion Detection System." IEEE Transactions On Systems, Man, and Cybernetics. Part B, Cybernetics : a Publication of the IEEE Systems, Man, and Cybernetics Society, vol. 37, no. 2, 2007, pp. 373-84.
Yu Z, Tsai JJ, Weigert T. An automatically tuning intrusion detection system. IEEE Trans Syst Man Cybern B Cybern. 2007;37(2):373-84.
Yu, Z., Tsai, J. J., & Weigert, T. (2007). An automatically tuning intrusion detection system. IEEE Transactions On Systems, Man, and Cybernetics. Part B, Cybernetics : a Publication of the IEEE Systems, Man, and Cybernetics Society, 37(2), 373-84.
Yu Z, Tsai JJ, Weigert T. An Automatically Tuning Intrusion Detection System. IEEE Trans Syst Man Cybern B Cybern. 2007;37(2):373-84. PubMed PMID: 17416165.
* Article titles in AMA citation format should be in sentence-case
TY - JOUR T1 - An automatically tuning intrusion detection system. AU - Yu,Zhenwei, AU - Tsai,Jeffrey J P, AU - Weigert,Thomas, PY - 2007/4/10/pubmed PY - 2007/5/2/medline PY - 2007/4/10/entrez SP - 373 EP - 84 JF - IEEE transactions on systems, man, and cybernetics. Part B, Cybernetics : a publication of the IEEE Systems, Man, and Cybernetics Society JO - IEEE Trans Syst Man Cybern B Cybern VL - 37 IS - 2 N2 - An intrusion detection system (IDS) is a security layer used to detect ongoing intrusive activities in information systems. Traditionally, intrusion detection relies on extensive knowledge of security experts, in particular, on their familiarity with the computer system to be protected. To reduce this dependence, various data-mining and machine learning techniques have been deployed for intrusion detection. An IDS is usually working in a dynamically changing environment, which forces continuous tuning of the intrusion detection model, in order to maintain sufficient performance. The manual tuning process required by current systems depends on the system operators in working out the tuning solution and in integrating it into the detection model. In this paper, an automatically tuning IDS (ATIDS) is presented. The proposed system will automatically tune the detection model on-the-fly according to the feedback provided by the system operator when false predictions are encountered. The system is evaluated using the KDDCup'99 intrusion detection dataset. Experimental results show that the system achieves up to 35% improvement in terms of misclassification cost when compared with a system lacking the tuning feature. If only 10% false predictions are used to tune the model, the system still achieves about 30% improvement. Moreover, when tuning is not delayed too long, the system can achieve about 20% improvement, with only 1.3% of the false predictions used to tune the model. The results of the experiments show that a practical system can be built based on ATIDS: system operators can focus on verification of predictions with low confidence, as only those predictions determined to be false will be used to tune the detection model. SN - 1083-4419 UR - https://www.unboundmedicine.com/medline/citation/17416165/An_automatically_tuning_intrusion_detection_system_ L2 - https://dx.doi.org/10.1109/tsmcb.2006.885306 DB - PRIME DP - Unbound Medicine ER -