WIXLIB

International Journal of Information Communication Technology and Digital ConvergenceVol. 4, No. 1, June 2019, pp. 1-7Evaluation of Classifier for Efficient Intrusion Detection SystemImplementationKrishna PandeyESC Pvt Ltd, Kathmandu, NepalE-mail: kp.krispandey@gmail.comAbstractAbstract: Security breach has been recorded in high volume and has compromised severalInformation Systems and critical applications as well. An Intrusion Detection is the process ofanalyzing the events occurring in an information system in order to detect different security threatsand vulnerabilities. Research and development communities are putting their extra effort foroptimizing Intrusion Detection System performance as network data traffic includingvulnerabilities are found to be complex and have shown dynamic properties. The idea to explore ifcertain classifier perform better for certain attack classes constitutes the motivation for thisresearch work. In this research, performance of a comprehensive set of potential classifiers usingKnowledge Discovery and Data (KDD99) dataset has been evaluated. Based on evaluated results,maximum accurate classifier for high attack detection rate and low false alarm rate has beenchosen and suitable classifier has been proposed. The comparison of simulation result indicatesthat noticeable performance improvement can be achieved with the proposed classifier to detectdifferent kinds of network attacks and security vulnerabilities.Keywords: Intrusion Detection System (IDS), KDD99 dataset, Classifier selection, Security.1. IntroductionDue to remarkable escalation in networked computer resources, a variety of networkbased applications have been developed to provide services in many different areas, e.g.,e-Commerce services, e-Procurement services, entertainment etc. The increase in thenumber of networked machines has show the way to an increase in unauthorized activity,not only from outside attackers, but also from inside attackers, such as discontentedemployees and people abusing their privileges for personal gain. An intrusion is definedas any set of events that compromise the integrity, confidentiality or availability of aresource. If a system is capable to assure that these three security tokens are fulfilled, it isconsidered as secure. Intrusion detection (ID) is an approach of security managing schemefor computers and networks. ID is the process of monitoring and analyzing the actionsoccurring in a computer system in order to detect signs of security problems [1].Intrusion Detection Systems (IDS) are primarily focused on identifying probableincidents, monitoring information about them, tries to stop them, and reporting them tosecurity administrators in real-time environment, and those that exercise audit data withsome delay (non-real-time). The latter approach would in turn delay the instance ofdetection.Manuscript Received: 21 Jan. 2019 / Revised: 28 Mar. 2019 / Accepted: 10 Jun. 2019Corresponding Author: Krishna PandeyAuthor’s affiliation: ESC Pvt LtdE-mail: kp.krispandey@gmail.comISSN: 2466-0094Copyright IJICTDC

2Evaluation of Classifier for Efficient Intrusion Detection System ImplementationFigure 1. Simple Intrusion DetectionIn addition, organizations apply IDSs for other reasons, such as classifying problemswith security policies, documenting existing attacks, and preventing individuals fromviolating security policies. IDSs have become a basic addition to the securityinfrastructure of almost every organization. A usual Intrusion Detection System isdemonstrated in Figure 1.Intrusion Detection Systems are broadly classified into two types. They are host-basedand network-based intrusion detection systems. Host-based IDS employs audit logs andsystem calls as its data source, whereas network-based IDS employ network traffic as itsdata source. A host-based IDS consists of an agent on a host which identifies differentintrusions by analyzing audit logs, system calls, file system changes (binaries, passwordfiles, etc.), and other related host activities. In network-based IDS, sensors are placed atstrategic position within the network system to capture all incoming traffic flows andanalyze the contents of the individual packets for intrusive activities such as denial ofservice attacks, buffer overflow attacks, etc. Each approach has its own strengths andweaknesses. Some of the attacks can only be detected by host-based or only by networkbased IDS [2].There are two main strategies of ID: misuse detection and anomaly detection. Misusedetection attempts to match patterns and signatures of already recognized attacks in thenetwork traffic. A continuously updated database is usually used to accumulate thesignatures of known attacks. It cannot identify a novel attack until trained for them.Anomaly detection attempts to recognize behavior that does not conform to normalbehavior. This technique is based on the detection of traffic anomalies. The anomalydetection systems are adaptive in nature, they can deal with new attack, but they cannotidentify the specific type of attack.The main disadvantage of this method is that there is no clear-cut method for definingnormal behavior. Therefore, such type of IDS can report intrusion, even when the activityis legitimate. One of the major problems encountered by IDS is large number of falsepositive alerts that is the alerts that are mistakenly analyzed normal traffic as securityviolations. An ideal IDS does not produce false or inappropriate alarms. In practice,signature-based IDS found to produce more false alarms than expected. This is due to thevery general signatures and poor built in verification tool to authenticate the success ofthe attack. The large number of false positives in the alert logs generates the course oftaking corrective action for the true positives, i.e. delayed, successful attacks, and laborintensive.The ideal goal of efficient IDS is to detect novel attacks by unauthorized users innetwork traffic. We consider an attack to be novel if the vulnerability is unknown to thetarget's owner or administrator, even if the attack is generally known and patches and

IJICTDC 20193detection tests are available. There are basically four types of remotely launched attacks:denial of service (DOS), U2R, R2L, and Probes. A DoS (Denial of Service) attack is atype of attack in which the unauthorized users build a computing or memory resources toobusy or too full to provide reasonable networking requests and hence denying users accessto a machine e.g. ping of death, neptune, back, smurf, apache, UDP storm, mail bomb etc.are all DoS attacks. A remote to user (U2R) attack is an attack in which a user forwardsnetworking packets to a machine through the internet, which he/she does not have right ofaccess in order to expose the machines vulnerabilities and exploit privileges which a localuser would have on the computer e.g. guest, xlock, xnsnoop, sendmail dictionary, phf etc.A R2L attacks are regarded as the exploitations in which the unauthorized users start offon the system with a normal user account and tries to misuse vulnerabilities in the systemin order to achieve super user access rights e.g. xterm, perl. A probing is an attack inwhich the hacker scans a machine or a networking device in order to determineweaknesses or vulnerabilities that may later be exploited so as to negotiate the system.This practice is commonly used in data mining e.g. portsweep, saint, mscan, nmap etc.[2].1.1 Problem StatementIDS are a Rule Based Monitoring and Controlling System, therefore, selection ofalgorithm used to define standard rule base is a major challenge. The selection ofimproper algorithm and model can maximize the occurrence of false alarm rate, highresource consumption, and low intrusion detection rate and may result inefficiencyto entire system and may even lead to security vulnerabilities. The proper selectionof classifier algorithm leads to increase in efficiency of IDS being implemented.1.2 Research PurposeThe main objective of this research work is to recommend the best classificationalgorithm with performance assessment on different rule-based classificationtechnique to detect intrusions and anomalies for efficient and reliable IDSimplementation.This research work has recommended the best classification algorithm based oncomparative assessment of different algorithms that has been studied within the timeframe of this project duration.Several research works have already been done and many research papers havebeen published regarding improvement of intrusion detection system (IDS). Since,each of the papers has focused on different algorithmic techniques beingimplemented in IDS with their resulted output in simulation tools as well. However,the comparative analysis is very rare and proposed research is crucial in today’stime in order get the de-facto standard for efficient IDS implementation. There is aresearch work performed by G. Kalyani, A. Jaya Lakshmi on Nov 2012, entitled“Performance Assessment of Different Classification Techniques for IntrusionDetection”. The paper presents the comparison of different classification techniquesto detect and classify intrusions into normal and abnormal beha viours using WEKAtool. The algorithms or methods tested are Naive Bayes, j48, OneR, PART and RBFNetwork Algorithm. With a total data of 2747 rows and 42 columns have been usedto test and compare performance and accuracy among the classification methods thatare used. [1].The research work done by Hassan [3] “Current Studies on Intrusion DetectionSystem, Genetic Algorithm and Fuzzy Logic” includes that with the concept offuzzy logic, the false alarm rate in establishing intrusive activities can be reduced. Aset of efficient fuzzy rules can be used to define the normal and abnormal behaviorsin a computer network. [2]. Janakiraman and Vasudevan [4] performed a research

4Evaluation of Classifier for Efficient Intrusion Detection System Implementationwork entitled “An Intelligent Distributed Intrusion Detection System using GeneticAlgorithm”, this covers the distributed intrusion detection and prevention plays anincreasingly important role in securing computer networks. To overcome thelimitations of conventional intrusion detection systems, alerts are made indistributed intrusion detection system which are exchanged and correlated in acooperative fashion. This paper presents an intelligent learning approach usingGenetic Algorithm (GA) for distributed Intrusion Detection System (DIDS) [3].Abdullah et al. [5] have performed a research work entitled “PerformanceEvaluation of a Genetic Algorithm Based Approach to Network Intrusion DetectionSystem”. The purpose of the work was to apply genetic algorithm (GA) to networkintrusion detection system. Markey [6] performed the research work entitled “UsingDecision Tree Analysis for Intrusion Detection: A How-To Guide”. The worksuggested that data mining techniques, such as decision tree analysis, offer a semiautomated approach to detect adversely threats. Either approach allows corporationsor security teams to quickly, easily, and inexpensively implement decision treeanalysis and gain unique security insights based on the corporation’s network data.[5]2. MethodologyThe methodologies followed for this research work is shown in Figure 2.Figure 2. Implementation and Comparison Model of the System2.1 Implementation and Comparison ModelAs per the requirements of an Intrusion Detection system, the construction of theimplemented system consists of four major components as shown in in Figure. 2. Feature