A Hybrid Data Mining based Intrusion Detection System for Wireless Local Area Networks

Transcription

1 Internatonal Journal of Computer Applcatons ( ) A Hybrd Data Mnng based Intruson Detecton System for Wreless Local Area Networks M.Moorthy Professor, Department of MCA Muthayammal Engneerng College, Raspuram, S.Sathyabama PhD, Professor, Department of Computer Scence Truvalluvar Govt. Arts College, Raspuram ABSTRACT The exponental growth n wreless network faults, vulnerabltes, and attacks make the WLAN securty management a challengng research area [29]. Data mnng appled to ntruson detecton s an actve area of research. The man reason for usng data mnng technques for ntruson detecton systems s due to the enormous volume of exstng and newly appearng network data that requre processng. Data mnng follows anomaly based ntruson detecton. The drawback of the anomaly based ntruson detecton n a wreless network s the hgh rate of false postve. Ths can be solved by a desgnng a hybrd ntruson detecton system by connectng a msuse detecton module to the anomaly detecton module. In ths paper, we propose to develop a hybrd ntruson detecton system for wreless local area networks, based on Fuzzy logc. In ths Hybrd Intruson Detecton system, anomaly detecton s performed usng the Bayesan network technque and msuse detecton s performed usng the Support Vector Machne (SVM) technque. The overall decson of system s performed by the fuzzy logc. For anomaly detecton usng Bayesan network, each node has a montorng agent and a classfer wthn t for ts detecton and a moble agent for nformaton collecton. The anomaly s measured based on the naïve Bayesan technque. For msuse detecton usng SVM, all the data that le wthn the hyper plane are consdered to be normal whereas the data that le outsde the hyper plane are consdered to be ntrusve. The outputs of both anomaly detecton and msuse detecton modules are appled by the fuzzy decson rules to perform the fnal decson makng. Hybrd detecton system mproves the detecton performance by combnng the advantages of the msuse and anomaly detecton [33]. Keywords Intruson Detecton system (IDS), Wreless Local Area Network (WLAN), Support Vector Machne (SVM), Bayesan network, Montorng agent. 1. INTRODUCTION 1.1 Wreless LAN A Wreless Local Area Network (WLAN) uses some wreless dstrbuton method typcally spread spectrum or OFDM for lnkng two or more devces and n the wder nternet provdes connecton through access pont. Due to ths, along wth the connecton to the network, the users also obtan moblty to move around wthn a local coverage area. In wreless LAN or WLAN, also referred as LAWN for local area wreless network, moble users use wreless (rado) connecton to get connected to local area network, LAN ( 1.2 Intruson Detecton System Intruson Detecton s defned as the method of montorng the proceedngs takng place n a computer system or a network that are dverse from the usual actvtes of the system and hence detect t. An Intruson Detecton system (IDS) s a program that consders the happenngs n the system durng an executon and based on some unusual ndcatons fnds out f the system s msused. An IDS does not affect the use of the preventve mechansm n the system but n turn acts as the last defensve means n the system securty [2]. In network securty research, Intruson Detecton s a crtcal ssue. The two basc approaches of ntruson detecton are msuse detecton and anomaly detecton. Intruson Detecton System accumulates and nspects the data to be aware of the ntrusons and mshandlngs n the computer system and network. An ntruson detecton system (IDS) s a securty mechansm that can montor and detect ntrusons to the computer systems n real tme [21]. Intruson detecton system (IDS) s the process of detectng and dentfyng unauthorzed or unusual actvty on the system [22, 23]. In recent years, ntruson detecton has emerged as an mportant technque for network securty. Data mnng technques have been appled as a new approach for ntruson detecton [25]. Intruson detecton n fact s a classfcaton task that classfes network traffcs nto normal usage category or attack category [26]. Intruson Detecton Systems (IDSs) s needed to be the second lne of defense to protect the network from securty problem [27]. Machne learnng s regarded as an effectve tool utlzed by ntruson detecton system (IDS) to detect abnormal actvtes from network traffc. In partcular, neural networks, support vector machnes (SVM) and decson trees are three sgnfcant and popular schemes borrowed from the machne learnng communty nto ntruson detecton n recent academc research [32]. The potental threats and attacks that can be caused by ntrusons have been ncreased rapdly due to the dependence on network and nternet connectvty [36]. 1.3 Anomaly Based Intruson Detecton System Anomaly s any happenng or entty that s eccentrc, abnormal or specal. It can also ndcate an nconsstency or dvergence from the preset rule or tendency. A normal behavor s modeled for anomaly detecton. Any proceedngs whch contravene ths model wll be marked as suspcous. For example, a normal passve publc web can be consdered to gve rse to worm nfecton f t tres to open connectons to a large number of addresses [3]. 19

2 Internatonal Journal of Computer Applcatons ( ) An Anomaly Based Intruson Detecton System s a system for fndng the ntrusons and msuse n the computer by montorng the system actvty and classfes the actvtes as normal or anomalous. Ths system wll detect any type of msuse that falls out of the normal system operaton snce the classfcaton s completely based on rules or heurstcs, rather than patterns or sgnatures ( Anomaly-based detecton methods have receved an ncreasng nterest by scentfc communty n the last years [24]. Anomaly based detecton system seeks devatons from the learned model of normal behavor [28]. An anomaly based IDS analyze the ongong traffc, actvty, transactons or behavors for detectng anomales n the system or the network whch may be ndcatve of any attack. In recent years, data mnng - based ntruson detecton systems (IDSs) have demonstrated hgh accuracy, good generalzaton to novel types of ntruson, and robust behavor n a changng envronment [34]. An Intruson Detecton System (IDS) s a program that analyzes what happens or has happened durng an executon and tres to fnd ndcatons that the computer has been msused [40]. The development of anomaly detecton technques sutable for Wreless Sensor Networks (WSN) s regarded as an essental research area, whch wll enable WSNs to be much more secured and relable [42]. 1.4 Wreless Intruson Detecton System Montorng and nspectng the actvtes of the user and system, dentfyng the patterns of the already known attacks, recognzng abnormal actvtes of the network and detectng any polcy volatons for WLANs, are the man objectve of the wreless IDS. Wreless IDSs accumulate all nformaton about all the local wreless transmssons and produce alerts based on the predefned sgnatures or anomales n the traffc. Wreless Intruson Detecton Systems are constructed manly to recognze attacks targeted on a networks. [5]. 1.5 Anomaly Based IDS on WLAN To assst n the defense and detecton of the potental threats, WLAN employs solutons for securty ncludng anomaly based ntruson detecton system by collectng and nspectng nformaton related to the system for recognzng the wreless network ntrusons [6]. A WLAN IDS should montor for both network based attacks and wreless specfc attacks. In case of WLANs, the sensors used n the wreless networks can be of the standalone devce type to montor the wreless traffc wthout forwardng the traffc. The type of anomales detected by the WLAN are unauthorzed WLANs and wreless devces, poorly secured WLAN devces, unusual usage patterns, wreless scanners war drvng tools, DoS attacks, and man n the mddle (MITM) attacks. The hybrd ntruson detecton model combnes the ndvdual base classfers and other hybrd machne learnng paradgms to maxmze detecton accuracy and mnmze computatonal complexty [41]. 2. RELATED WORK Neveen I Ghal [2] used a new hybrd algorthm RSNNA (Rough Set Neural Network Algorthm) to sgnfcantly reduce a number of computer resources, both memory and CPU tme, requred to detect an attack. The algorthm uses Rough Set theory n order to select out feature reducts and a traned artfcal neural network to dentfy any knd of new attaches. R. Nakkeeran et al [7] ncorporated agents and data mnng technques to prevent anomaly ntruson n moble adhoc networks. Home agents present n each system collects the data from ts own system and usng data mnng technques to observed the local anomales. The Moble agents montorng the neghborng nodes and collect the nformaton from neghborng home agents to determne the correlaton among the observed anomalous patterns before t wll send the data. Ths system was able to stop all of the successful attacks n an adhoc networks and reduce the false alarm postves. Mrutyunjaya Panda et al [8] proposed a novel classfcaton va sequental nformaton bottleneck (sib) clusterng algorthm to buld an effcent anomaly based network ntruson detecton model. The proposed approach provdes better detecton accuracy wth comparatvely low false postve rate n comparson to other exstng unsupervsed clusterng algorthms. Ths makes the approach sutable for buldng an effcent anomaly based network ntruson detecton model. The drawback of ths approach s that only lmted data mnng technques are used, detecton accuracy s not close tom100% and has hgh false postve rate. The future research wll be to nvestgate other data mnng technques wth a vew to enhance the detecton accuracy as close as possble to 100% whle mantanng a low false postve rate. Qngle Zhang et al [9] proposed a framework for a new approach n ntruson detecton by combnng two exstng machne learnng methods (.e. SVM and CSOACN). The IDS based on the new algorthm can be appled as pure SVM, pure CSOACN or ther combnaton by constructng the detecton classfer under three dfferent tranng modes respectvely. The drawback s that the algorthm s not completely enhanced; tranng and testng speed s low. The future work s the enhancement of the algorthm n some aspects. For example, the tranng and testng speeds may be mproved by applyng the dmenson reducton on the nput data. More experments on performance evaluaton are also expected. M. Mehd et al [10] proposed a new approach of an anomaly Intruson detecton system (IDS). It conssts of buldng a reference behavour model and the use of a Bayesan classfcaton procedure assocated to unsupervsed learnng algorthm to evaluate the devaton between current and reference behavour. Contnuous re-estmaton of model parameters allows for real tme operaton. The use of recursve Log-lkelhood and entropy estmaton as a measure for montorng model degradaton related wth behavor changes and the assocated model update show that the accuracy of the event classfcaton process s sgnfcantly mproved usng ther proposed approach for reducng the mssng alarm. These algorthms have some lmtatons such as that the kernel dstrbutons are used to model numercal data wth contnuous and unbounded nature, the Gaussan parametrcal model may not be sutable for complex data and that the use of mxed models assumes statstcal ndependence between trals, whch can be restrctve n some cases. 3. ANOMALY DETECTION BASED ON BAYESIAN NETWORK A new approach to detect and prevent the attacks n computer networks can be represented by the Bayesan Networks. The depcton of the causal dependences between random varables n Bayesan Networks s gven n graphcal form. By specfyng just a small set of probabltes concernng only to the neghbor nodes, the jont probablty dstrbuton of the random varables can be calculated. Ths set wll have the nformaton about the pror probabltes of all root nodes and condtonal probabltes of all non root nodes provded wth all possble combnaton of ther drect predecessors. Bayesan Networks are the drected acyclc graph, (DAG) whch contans arcs for representng the causal dependence between 20

3 Internatonal Journal of Computer Applcatons ( ) the parent and chld allows the accumulaton of the proofs when the values are known about some varables and f the proof s known then t provdes a computatonal structure for fndng the condtonal values of the remanng random varables. Naves Bayes Classfer should be consdered n detectng network ntrusons due to ts comparable performance wth multple Bayesan classfers approach. Moreover, tme spent for buldng a NBC was less compared to others [30]. The advantages provded by the Bayesan Network are very sgnfcant and cannot be mplemented by other technque. Event relatons are not based on the expert knowledge but represent the mutual relatons between events n the specfed doman. In ths technque, unnecessary communcaton and processng overload are prevented snce the events used to estmate the probablty of the attacks are nspected at the locaton of the network where t occurred. Hence, the problem of varous control record msmatch does not arse. When calculatng the nfluence of the newly produced events on the others, the advantage of the Bayesan Network s unque compared to other technque. Also, the data and rules from other systems can be converted nto IDS based on Bayesan networks. In Bayesan networks, the platform used for executon does not affect the compatblty of the correspondng software products. Hence, the development and applcaton of the standalone and dstrbuted IDS can be speed up. Bayesan network can be consdered as an mportant and central part of the system snce, t provdes us wth the estmate of the probablty that an attack s gong on when the network s fed wth the needed data [10]. For behavor modelng and Bayesan based detecton, an anomaly IDS desgn wth a parametrc mxture can be used. Model parameter re-estmaton should be performed to ensure contnuous system update. For real tme operatons, algorthms for detecton and update phases are desgned. Hence, Bayesan technque can be used to perform anomaly ntruson detecton. Our approach s entrely based on anomaly based method, whch has been used to address securty problems related to attacks n a wreless networks. It provdes the three dfferent technques to provde suffce securty soluton to current node, Neghborng Node and Global networks. The followng secton outlnes each module s work n detal Montorng agent Montorng agent s a must n every system and ts functon s to collect nformaton from applcaton layer to the routng layer n ts system. Our proposed system provdes soluton usng three technques. It montors both, ts own system as well as ts envronment local anomaly can be detected usng a classfer constructon. Fg. 1: Outlne of the System Archtecture Fg. 2: System Archtecture When the node has to transfer nformaton from node G to B, t wll ntate by broadcastng a message to F and A. Pror sendng the message, node G collects nformaton about the neghborng nodes F and B usng the moble agent. It uses the classfer rule to detect the attacks usng the test tran data. The same type of soluton s provded throughout the global networks. It has been explaned n the followng sectons 1) Current node Montorng Agent present n the system, contnuously montors ts own system. Current node calls the classfer constructon to detect attacks whenever an attacker sends packet to collect nformaton or broadcast through ths system. In case of attacks, the respectve system wll be fltered out from the global networks. 2) Neghborng node In the network, any system n order to transfer nformaton to other system, broadcasts the nformaton through ntermedate system. Pror transferrng the message, current node sends the moble agent to the neghborng agent to collect all the nformaton. After gatherng the nformaton, t returns back to the system and calls the classfer rules to detect the attacks. If no suspcous actvty s detected, then the message wll be forwarded to the neghborng node. 3) Data collecton Data collecton module s used n every anomaly subsystem to gather feature values for correspondng layer n a system. The data collected durng the normal scenaro s saved as a profle. Durng the attack scenaro, the attack data s collected. 4) Data preprocess The audt data collected s stored n a fle and smoothed so that t becomes sutable for anomaly detecton. In Data preprocess, the nformaton s processed wth the test tran data. For the entre layer anomaly detecton systems, the above mentoned preprocessng technque s used [11] Cross Feature Analyss for Classfer Sub Model Constructon 1) Gven a tranng data D { t1,, tn} where t { t1,, th} and the tranng data D contans the followng attrbutes { A1, A2,, An} and each attrbute A contans the followng attrbute values { A1, A2,, Ah}. Also the tranng data D contans a set of classes C C1, C2,, C }. The probablty P s { m 21

4 Internatonal Journal of Computer Applcatons ( ) calculated usng the tranng data set usng Naïve Bayesan classfcaton algorthm. Nave Bayesan Algorthm used: Input: Tranng Data, D Output: Adaptve Intruson Detecton Model, AIDM Procedure: Step 1: Search the multple copes of same example n D, f found then keeps only one unque example n D. Step 2: For each contnuous attrbutes n D fnd the each adjacent par of contnuous attrbute values that are not classfed nto the same class value for that contnuous attrbute. Step 3: Calculate the pror probabltes P (Cj) and condtonal probabltes P ( Aj Cj) n D. Step 4: Classfy all the tranng examples usng these pror and condtonal probabltes, P ( e c ) P( c ) P( ) j j k 1 p Aj C j (1) Step 5: Update the class value for each example n D wth Maxmum Lkelhood (ML) of Posteror probablty, P ( c e ); c c ( c e ) j j ML j P (2) Step 6: Recalculate the pror P (Cj) and condtonal P ( Aj Cj) probabltes usng updated class values n D. Step 7: Agan classfy all tranng examples n D usng updated probablty values. Step 8: If any tranng examples n D s msclassfed then calculate the nformaton gan for each attrbutes A { A1, A2,, An} n D usng equaton Informaton Gan ( A ) Info( D) Info( T) Where c m freq(, D) freq(, D) j j Info( D) log [ ] 2 j 1 D D Info( T) n 1 T nf T ( T) Step 9: Choose the best attrbute A from D wth the maxmum nformaton gan value. Step 10: Splt dataset D nto sub-datasets { D1, D2,, Dn} dependng on the attrbute values of A. Step 11: Calculate the pror P (Cj) and condtonal P ( Aj Cj) probabltes of each sub-dataset D. Step 12: Classfy the examples of each sub-dataset D wth ther respectve pror and condtonal probabltes. Step 13: If any example of any sub-dataset D s msclassfed then agan calculate the c (3) (4) nformaton gan of attrbutes for that sub-dataset D, and choose one of the best attrbute A wth maxmum nformaton gan, then splt the sub-dataset D nto sub-subdatasets Dj. Then agan calculate the probabltes for each sub-sub-dataset Dj. Also classfy the examples n sub-sub datasets usng ther respectve probabltes. Step 14: Contnue ths process untl all the examples are correctly classfed. Step 15: Preserved all the pror and condtonal probabltes for each dataset for future classfcaton of unseen examples [12]. 2) Compute the average probablty for each data D, and save n a probablty dstrbuton matrx M. A decson threshold 0 s learned from the tranng data set. Normal profle s created usng the threshold value. If the probablty s greater than threshold value t s labeled as normal, otherwse t s labeled as abnormal. Anomaly detecton Input: Preprocessed tran data, preprocessed test data Output: Percentage of anomaly 1) Read processed data set fle 2) Call Bayesan classfer program for tranng the classfer for anomaly detecton 3) Read the test data fle 4) Test the classfer model wth the test data fle 5) Prnt the confuson matrx to show the actual class vs predcted class 6) Percentage of anomaly s calculated as follows P n( PA) *100 n( TT ) Where P : Percentage : Number of predcted anomales n (PA) n (TT) : Total number of traces 4. MISUSE DETECTION BASED ON SUPPORT VECTOR MACHINE The concept of msuse detecton s to create a pattern or a sgnature form so that the attack s detected when repeated. Hence, the man lmtaton of the msuse detecton s that, t cannot detect new types of attacks. The IDS mantans a pattern database consstng of the sgnature of the possble attacks. Msuse detecton usually provdes a low false postve rate [13]. SVM has been wdely used for ntruson detecton as a classcal pattern recognton tool. Network Intruson Detecton usng SVM s better than artfcal neural network [31]. Support vector machne (SVM) s used for classfcaton n IDS due to ts good generalzaton ablty and non lnear classfcaton usng dfferent kernel functons and performs well as compared to other classfers [35]. There are three phases n the constructon of the SVM ntruson detecton systems. The frst phase s the preprocessng phase, whch processes the randomly selected raw TCP/IP dump data usng automated parsers and converts t nto machne readable form. The second phase s the tranng phase n whch the SVMs are traned on dfferent types of attacks and normal data. The data has a total of 41 nput features and can be classfed nto two categores: (5) 22

5 Internatonal Journal of Computer Applcatons ( ) normal (+1) and attack (-1). The SVM wll be traned wth both the type of data: normal as well as ntrusve data. The fnal phase s the testng phase. Ths tranng phase nvolves measurng the performance of the data beng tested. Theoretcally, the SVMs are the learnng machnes whch plot all the tranng vectors n hgh dmensonal feature space and all the vectors are labeled accordng to ther class. In SVMs the data s classfed based on the support vectors that are the members of the tranng nput set outlnng a hyper plane n the feature space. The process of classfyng the data nto 2 classes nvolves dvdng the data nto normal and attack. The attack class n turn conssts of 22 dfferent types of attacks whch can be grouped nto four classes: DoS attack, unauthorzed access from a remote machne, unauthorzed access to a local super user prvleges, or survellance and other probng. The man objectve of the SVMs s to separate the normal (1) and ntrusve (-1) data. So, the SVMs are traned wth both normal and ntrusve patterns. Bnary classfcaton and regresson are the prmary advantages of SVMs whch means the low expected probablty of generalzaton errors along wth other advantages. Speed s another mportant advantage n SVM snce real tme performance s very mportant. SVMs are hghly scalable and are nsenstve to number of data ponts. In SVM the classfcaton complexty s ndependent of the dmensonalty of the feature space. The fnal advantage s due to the dynamc nature of the attack patterns whch allows the dynamc update of the tranng patterns by the SVMs [14]. Four measures adapted from nformaton retreval are used to evaluate the performance of an SVM model: Precson = A/ A B, Recall = A/ A C, False negatve rate = C / A C, And False postve rate = B/ B D. A, B, C, and D represent the number of detected ntrusons, not ntrusons but detected as ntrusons, not detected ntrusons, and not detected non-ntrusons respectvely. A false negatve occurs when an ntruson acton has occurred but the system consders t as a non-ntrusve behavor. A false postve occurs when the system classfes an acton as an ntruson whle t s a legtmate acton. Bnary classfcaton problems can be solved usng SVM [4]. An SVM maps lnear algorthms nto non-lnear space. It uses a feature called, kernel functon, for ths mappng. Kernel functons lke polynomal, radal bass functon are used to dvde the feature space by constructng a hyper plane. The kernel functons can be used at the tme of tranng of the classfers whch selects support vectors along the surface of ths functon. SVM classfy data by usng these support vectors that outlne the hyper plane n the feature space [15]. A basc nput data format and output data domans are lsted as follows. m ( x, y ),...,( x, y ), x R, y { 1, 1} n ( y y x x n Where, ),...,(, ) are a tranng data, n s the n n numbers of samples, m s the nputs vector, and y belongs to category of +1 or -1 respectvely. On the problem of lnear, a hyper plan can dvded nto the two categores. The hyper plan formula s: ( w. x) b 0 The category formula s: ( w. x) b f y ( w. x) b f y 1 1 Fg. 3: Hyper plane Of SVM [16] Ths process wll nvolve a quadratc programmng problem. Consder a hyper-plane defned by (w, b), where w s a weght vector and b s a bas. The classfcaton of a new object x s done wth f ( x) sgn( w. x b) sgn( (. x) b) N y x The tranng vectors x occur only n the form of a dot product. For each tranng pont, there s a Lagrangan multpler. The Lagrangan multpler values α reflect the mportance of each data pont. When the maxmal margn hyper-plane s found, only ponts that le closest to the hyperplane wll have 0 and these ponts are called support vectors. All other ponts wll have 0. That means only those ponts that le closest to the hyper-plane, gve the representaton of the hypothess/classfer. These data ponts serve as support vectors. Ther values can be used to gve an ndependent boundary wth regard to the relablty of the hypothess/classfer. Our proposed system, prepares for fve types of labeled data. Ths data nclude four types of attacks and normal data. We use KDD CUP 99 ntruson detecton data set (TCP dump data), whch s most commonly used for evaluaton. The data has 41 attrbutes for each connecton record plus one class label. The data set contans 24 attack types, whch are categorzed nto four types as follows: 1. Denal of Servce (DOS): In ths type of attack legtmate user s dened to access a machne by makng some computng resources or memory full. For example TCP SYN, Back, etc. 2. Remote to User (R2L): In ths type of attack remote user tres to gan local access as the user of the machne. For example FTP_wrte, Guest etc. 3. User to Root (U2R): In ths type of attack the attacker tres to gan root access to the system. For example Eject, Fdformat etc. 4. Probng: In ths type of attack attacker tres to scan a network of computer to fne known vulnerabltes or to gather nformaton. For example Ipsweep, Mscan [14]. (6) 23

6 Internatonal Journal of Computer Applcatons ( ) We propose the algorthm for our IDS, as t gves better performance results for multclass classfcaton. The structure of the resultng SVM s determned by dstance between two class patterns and the number of each class patterns. Let n denote the number of th class patterns x, where 1,2,, k. The center pont of th class patterns s calculated usng followng equaton: c n m 1 x n m (7) The Eucldan dstance between th class and jth class patterns s calculated as follows: Ed j c c j (8) The separablty or the dstrbuton of two class patterns s gven by a dstance equaton as follows: Where, d j n m 1 Ed x m n j j c (10) Obvously dj equals to dj. Fnd a par ) by calculatng the dstances of all par wse classes, (, j where the dstance between x and xj s extreme. The fve classes are denoted by a set { A, B, C, D, E}. The dstance between Class A and E, dae s bggest. In the par ( A, H), let A be Class 1 and E be Class 1. Next, separate the rest three class patterns { B, C, D} nto two classes (Class 1 or 1). Compare the dstances dba wth dbe. The dstance dba dbe (9), so Class B s put nto Class 1. Smlarly, calculate the dstances for C and D, where dca dce, dda dde. At last, compare the number of patterns n Class 1and 1. At the end the fve class patterns are dvded nto two subsets: { A, B, C} and { D, E}. Thus now the result wll contan 2 classes; ntrusve and normal. 5. DECISION MAKING BASED ON FUZZY LOGIC The two mportant reasons for the selecton of fuzzy logc n solvng the ntruson detecton problem: frst, nvolvement of many quanttatve features n ntrusve detecton. SRI s Nextgeneraton Intruson Detecton Expert System (NIDES) dvdes the statstcal measurement related to securty nto four knds: ordnal, categorcal, bnary categorcal and lnear categorcal. The measurements n the ordnal and lnear categorcal are quanttatve features that can be vewed as fuzzy varables. The CPU usage tme and the connecton duraton are the two examples of the ordnal measurements. The number of the dfferent TCP/UDP servces ntated by the same source host s the example lnear categorcal measurement. The second reason for the use of fuzzy logc n solvng the ntruson detecton problem s because of the fuzzness n the securty. An nterval can be used to denote a normal value whenever the quanttatve measurement s gven and all the values fallng outsde the nterval wll be regarded to be anomalous rrespectve of ts dstance to the nterval. All the values wthn the nterval wll be consdered as normal rrespectve of ts dstance. The use of fuzzness smoothen the abrupt separaton of normalty and abnormalty whle representng the quanttatve features. The measure of degree of normalty and abnormalty can also be provded by the use of fuzzness [17]. Our choce for usng Fuzzy Logc was based on two man reasons: (1) No clear boundares exst between normal and abnormal events, (2) fuzzy logc rules help n smoothng the abrupt separaton of normalty and abnormalty (anomaly). A fuzzy set may be represented by a mathematcal formulaton known as a membershp functon. The normal and abnormal behavors n networked computers are hard to predct, as the boundares cannot be well defned [37]. Fuzzy logc has been orgnally proposed by Zadeh as a tool for dealng wth lngustc uncertanty and vagueness ubqutous n the mprecse meanng of words [38]. Fuzzy systems have demonstrated ther ablty to solve dfferent knds of problems n varous applcatons domans [39]. A fuzzy-based nference mechansm s used to nfer a soft boundary between anomalous and normal behavour, whch s otherwse very dffcult to determne when they overlap or are very close [43]. Rule Defnton: A fuzzy set A n X s characterzed by a membershp functon whch s easly mplemented by fuzzy condtonal statements. In the case of fuzzy statement f the antecedent s true to some degree of membershp then the consequent s also true to that same degree. The rule structure: If antecedent then consequent. The rule: If varable1 s low and varable2 s hgh then output s bengn else output s malgnant. In a fuzzy classfcaton system, a case or an object can be classfed by applyng a set of fuzzy rules based on the lngustc values of ts attrbutes. Every rule has a weght, whch s a number between 0 and 1 and ths s appled to the number gven by the antecedent. It nvolves 2 dstnct parts. Frst the antecedent s evaluated, whch nvolves fuzzfyng the nput and applyng any necessary fuzzy operators and second applyng that result to the consequent known as nference. To buld a fuzzy classfcaton system, the most dffcult task s to fnd a set of fuzzy rules pertanng to the specfc classfcaton problem.. We explored three fuzzy rule generaton methods for ntruson detecton systems. 1. Rule generaton based on the hstogram of attrbute values (FR1) 2. Rule generaton based on partton of overlappng areas (FR2) 3. Neural learnng of fuzzy rules (FR3). When an attack s correctly classfed, the grade of certanty s ncreased and when an attack s msclassfed the grade of certanty s decreased. The fuzzy Logc n decson makng uses the followng technque: Let the two constrants to be consdered be the output of anomaly detecton, AD and msuse detecton, MD. The possbltes of the two constrants are completely abnormal CA, slghtly abnormal SA and completely normal CN. 24

7 Internatonal Journal of Computer Applcatons ( ) The frst constrant, Anomaly detecton can be represented n fuzzy set as AnomalyDetecton = FuzzySet [{ CA, x},{ SA, y},{ CN, z}] Where x s the membershp grade for Completely output n Anomaly Detecton y s the membershp grade for Slghtly output n Anomaly Detecton z s the membershp grade for Completely Normal output n Anomaly Detecton MsuseDetecton= FuzzySet [{ CA, a},{ SA, b},{ CN, c}] Where a s the membershp grade for Completely output n Msuse Detecton b s the membershp grade for Slghtly output n Msuse Detecton c s the membershp grade for Completely Normal output n Msuse Detecton The fnal decson s based on the output of the ntersecton of the correspondng members of the fuzzy sets of the two constrants; anomaly detecton and msuse detecton. The output wth the hghest membershp grade wll be consdered as the result of the system. In our system, fuzzy logc s used for decson makng based on nput from Bayesan classfer system and Support Vector Machne. There are 3 output possbltes n our fuzzy system; normal, slghtly abnormal and completely abnormal. Table.1 shows the condtons for decson makng n fuzzy logc for nputs from Bayesan network and Support Vector Machne. The Fgure.3 shows the block representaton of the decson makng n our fuzzy system. Table 1: Condtons for Decson Makng n Fuzzy Logc Decson Bayesan Support Vector Makng Network Machne based on the Output Output Fuzzy Logc Normal Normal Normal Normal Normal Slghtly Slghtly Completely The condton for makng the decson follows an f-then rule where f the output of both the modules are normal wthout any attack or problem causng component, then the decson s made as normal output, f the output of one module s normal and the other module s abnormal then the decson made s slghtly abnormal, f the output of both the modules s abnormal then the decson made s completely abnormal. Fg 4: Decson Makng Archtecture The archtecture for decson makng shows the nput data to be tested appled separately nto anomaly detecton module and msuse detecton module. The anomaly detecton s based on the Bayesan networks and the msuse detecton s based on the Support Vector Machne technque. The output of both the module s then fuzzfed and then appled to the decson makng module. Here the decson s based on the condtons of fuzzy logc. The output from the decson makng module s then defuzzfed and provded as result. Let us consder an example wth sets gven AnomalyDetecton = FuzzySet [{ CA,.5}, { SA,.7},{ CN,.3}] We can see that possblty for SA has the hghest membershp functon meanng that possblty SA s the most hghly detected of the two possbltes. Possblty for CN on the other hand s the least detected, snce t has a membershp grade of only 0.3. The second constrant, Msuse detecton can be represented n fuzzy set as MsuseDetecton= FuzzySet [{ CA,.2}, { SA,.6},{ CN,.7}] We can see that possblty for CN has the hghest membershp functon meanng that the possblty CN s the most hghly detected of the two possbltes. Possblty for CA on the other hand s the leas\t detected, snce t has a membershp grade of 0.2. ( /fuzzylogc/examples/job.html) Decson = Intersecton [AnomalyDetecton, MsuseDetecton] [{ CA,.2}, { SA,.6},{ CN,.3}] FuzzySet We can plot the decson fuzzy set to see the results graphcally, Fuzzyplot [Decson] 25

8 Falsepostve Msdetect Delvery rato Fg. 5: Fuzzy Plot Fuzzyplot [Decson, Plotjoned True] Internatonal Journal of Computer Applcatons ( ) 6.2 Performance Metrcs In our experments, we measure the followng metrcs Receved Bandwdth Packet Loss Msdetecton False Postve Packet Delvery Rato The smulaton results are descrbed n the next secton. 6.3 Results A. Effect of Varyng Rates We vary the attack traffc rate as 50,100,150,200 and 250kb. Rate vs Delvery rato Fg. 6: Contnuous Fuzzy Plot Defuzzfcaton of the fuzzfed values can be performed by varous ways lke centrod average method, max centre method, mean of maxma, smallest of maxmum and largest of maxmum. In our case, we defuzzfy usng the maxmum method ( Lecture12/sld034.htm). The result obtaned n our case s SA, snce t has the maxmum membershp grade. Hence, we fnd that Slghtly appears to be the best decson for the gven constrant. 6. SIMULATION RESULTS Ths secton deals wth the expermental performance evaluaton of our algorthm through smulatons. In order to test our protocol, the NS2 smulator [20] s used. We compare our proposed HF-IDS technque wth the HIDS [9] technque. 6.1 Smulaton Setup In the smulaton, the number of nodes s kept as 100. The nodes are arranged n a 1000 meter x 1000 meter square regon for 60 seconds of smulaton tme. All nodes have the same transmsson range of 250 meters. The smulated traffc s TCP and Constant Bt Rate (CBR). The smulaton settngs and parameters are summarzed n table 2. Table 2: Smulaton Parameters No. of Nodes 100 Area 1000 X 1000 Mac Rado Range 250m Smulaton Tme 60 sec Traffc Source CBR,TCP Rate 50 to 250kb/s Packet Sze 512 B Attackers 2,4,6,8 and Rate Fg. 7: Rate Vs Delvery Rato 0 Rate vs Msdetect Rate Fg. 8: Rate Vs Msdetect Rate vs Falsepostve Rate Fg. 9: Rate Vs False Postve HIDS HF-IDS HIDS HF-IDS HIDS HF-IDS Fg. 7 shows the delvery rato of our HF-IDS technque and HIDS. From the fgure, we can see that packet delvery rato s more n HF-IDS scheme when compared wth HIDS scheme. Fg. 8 shows the msdetecton rato of HF-IDS technque and HIDS. From the fgure, we can see that the msdetecton rato s sgnfcantly less n our HF-IDS scheme when compared wth HIDS scheme, snce t accurately detects the ntruson. 26

9 Bandwdth (Mb/s) Internatonal Journal of Computer Applcatons ( ) Fg. 9 shows the false postve rate of our HF-IDS technque and HIDS. From the fgure, we can observe that our HF-IDS scheme attans low false postve rate, when compared wth HIDS scheme, snce t accurately detects the ntruson. B. Effect of Varyng Attackers In our second experment, we vary the number of attackers as 2, 4, 6 and 8 n order to calculate the receved bandwdth and packet loss of legtmate users Attackers Vs Bandwdth receved Attackers Fg. 10: Attackers Vs Bandwdth Fg. 11: Attackers Vs Loss HF-IDS HIDS Fg. 10 gves the receved bandwdth for normal legtmate users when varyng the number of attackers. It shows that the bandwdth receved for normal users s more n the case of HF-IDS when compared wth HIDS. Fg. 11 llustrates that the packet loss due to attack s more n HIDS when compared wth HF-IDS, when varyng the number of attackers. 7. CONCLUSION In ths paper, we have developed an effcent hybrd ntruson detecton system usng data mnng algorthms to ensure securty n the system from the attacks possble. In our hybrd ntruson detecton system, a msuse detecton module s connected to the anomaly detecton module. The anomalous detecton system s based on Bayesan technque and msuse detecton system s based on SVM. The decson makng system s based on fuzzy logc. Ths methodology of fndng the ntruson n the system s sutable snce both anomaly and msuse detecton are separately performed and the overall system status s cross checked by the decson makng module processed by the fuzzy technque. It prevents any erroneous nterpretaton and the securty of the system s represented n the fuzzy form snce the degree of securty s also fuzzy n nature. Ths hybrd technque s very scalable and accurate snce ncorrect nterpretaton s not possble due double check n ths technque. Hence, hybrd technque of ntruson detecton s very effcent to mantan securty n the system. The future research wll be to nvestgate other data mnng technques wth a vew to enhance detecton rate as close as possble to 100%, wth less false postve rate. 8. REFERENCES [1] [2] Neveen I. Ghal, Feature Selecton for Effectve Anomaly-Based Intruson Detecton, IJCSNS Internatonal Journal of Computer Scence and Network Securty, VOL.9 No.3, March [3] Jatnder Sngh, Dr. Lakhwnder Kaur and Dr. Savta Gupta, Analyss of Intruson Detecton Tools for Wreless Local Area Networks, IJCSNS Internatonal Journal of Computer Scence and Network S 168 ecurty, Vol.9 No.7, July [4] [5] ed_to_know_about_intruson_detecton_systems.html ds-and-ps/wreless-ds.html [6] Shu Yun Lm and Andy Jones, An Anomaly-based Intruson Detecton Archtecture to Secure Wreless Networks. [7] Qngle Zhang and Wenyng Feng, Network Intruson Detecton by Support Vectors and Ant Colony, ISBN , Proceedngs of the 2009 Internatonal Workshop on Informaton Securty and Applcaton (IWISA 2009), Qngdao, Chna, November 21-22, [8] Mrutyunjaya Panda and Manas Ranjan Patra, A Novel Classfcaton va Clusterng Method for Anomaly Based Network Intruson Detecton System, Internatonal Journal of Recent Trends n Engneerng, Vol 2, No. 1, November [9] K.Q. Yan, S.C. Wang, C.W. Lu, A Hybrd Intruson Detecton System of Cluster-based Wreless Sensor Networks, Proceedngs of the Internatonal MultConference of Engneers and Computer Scentsts 2009 Vol I, IMECS 2009, March 18-20, 2009, Hong Kong. [10] M. Mehd, S. Zar, A. Anou and M. Bensebt, A Bayesan Networks n Intruson Detecton Systems, Journal of Computer Scence 3 (5): , 2007, ISSN , 2007 Scence Publcatons. [11] R. Nakkeeran, T. Aruldoss Albert and R.Ezumala, Agent Based Effcent Anomaly Intruson Detecton System n Adhoc networks, IACSIT Internatonal Journal of Engneerng and Technology Vol. 2, No.1, February, 2010 ISSN: [12] Dewan Md. Fard, Noura Harb, and Mohammad Zahdur Rahman, Combnng Nave Bayes And Decson Tree For Adaptve Intruson Detecton, 27

10 Internatonal Journal of Computer Applcatons ( ) Internatonal Journal of Network Securty & Its Applcatons (IJNSA), Volume 2, Number 2, Aprl [13] Rung-Chng Chen and Su-Png Chen, Intruson Detecton Usng A Hybrd Support Vector Machne Based On Entropy And Tf-Idf, Internatonal Journal of Innovatve Computng, Informaton and Control, Volume 4, Number 2, February 2008, ICIC Internatonal c 2008 ISSN [14] Harley Kozushko, Intruson Detecton: Host-Based and Network-Based Intruson Detecton Systems, September 11, 2003 Independent Study [15] Snehal A. Mulay, P.R. Devale and G.V. Garje, Intruson Detecton System Usng Support Vector Machne and Decson Tree, Internatonal Journal of Computer Applcatons ( ) Volume 3 No.3, June [16] Rung-Chng Chen, Ka-Fan Cheng and Cha-Fen Hseh, Usng Rough Set and Support Vector Machne for Network Intruson Detecton, Internatonal Journal of Network Securty & Its Applcatons (IJNSA), Vol 1, No 1, Aprl [17] Susan M. Brdges and Rayford B. Vaughn, Intruson Detecton Va Fuzzy Data Mnng, Accepted for Presentaton at The Twelfth Annual Canadan Informaton Technology Securty Symposum June 19-23, 2000, The Ottawa Congress Centre. [18] c/examples/job.html [19] htm [20] Network Smulator, [21] Jaydp Sen An Agent-Based Intruson Detecton System for Local Area Networks. n Internatonal Journal of Communcaton Networks and Informaton Securty (IJCNIS) Vol. 2, No. 2, 2010 [22] Guanln Chen, Hu Yao, Zebng Wang An Intellgent WLAN Intruson Preventon System Based on Sgnature Detecton and Plan Recognton, 2010 Second Internatonal Conference on Future Networks, pp , [23] Yuja Zhang, Guanln Chen, Wenyong weng, Zebng Wang An Overvew of Wreless Intruson Preventon Systems, 2010 Second Internatonal Conference on Communcaton System, Network and Applcatons, pp , ICCSNA, [24] Torres.L.M at el., An anomaly-based ntruson detecton system for IEEE networks, 2010, pages: 1-6 [25] Amudha. P et al., Performance Analyss of Data Mnng Approaches n Intruson Detecton, PACC, (2011), page: 1-6 [26] P.Srnvasu et al., Implementaton of Fuzzy C-Means and Dempster-Shafer Theory for Anomaly Intruson Detecton, IJCSNS (2011), Vol. 11 No. 9 pp [27] S.Tamlarasan, Aramudan, A Performance and Analyss of Msbehavng node n MANET usng Intruson Detecton System, IJCSNS (2011), Vol. 11 No. 5 pp [28] R. Sommer, V. Paxson, Outsde the Closed World: On Usng Machne Learnng For Network Intruson Detecton, n Proc. of IEEE Symp. On Securty and Prvacy, Oakland, Calforna, pp , 2010 [29] Haddad.F, Sarram M.A, 'Wreless ntruson detecton system usng lghtweght agent', ICCNT (2010), pp [30] Kok Chn Khor et al., Comparng Sngle and Multple Bayesan Classfers Approaches for Network Intruson Detecton, ICCEA (2010), pages: [31] Guan Xao Qng et al., Network ntruson detecton method based on Agent and SVM, ICIME (2010), chna, pp [32] Yu-Xn Meng et al., The practce on usng machne learnng for network anomaly ntruson detecton, ICMLC (2011), Volume-2, pp [33] Jong Zhang et al., Random-Forests-Based Network Intruson Detecton Systems, IEEE SMC (2008) 38(5), pp [34] Chetan.R et al., Data mnng based network ntruson detecton system: A database centrc approach, ICCCI (2012), pp. 1-6 [35] Noreen Kausar et al., Communcatons n Computer and Informaton Scence, 253(1) pp [36] Reyadh Shaker Naoum et al., An Enhanced Reslent Back propagaton Artfcal Neural Network for Intruson Detecton System, IJCSNS (2012), Vol. 12 No. 3, pp [37] Jng zhong et al., Intruson detecton usng evolvng fuzzy classfers, ITAIC (2011), pp [38] L. A. Zadeh, Fuzzy Sets, n Informaton and Control, vol. 8, pp , [39] Abadeh, M.S., Habb, J., Lucas, C., Intruson detecton usng a fuzzy genetcs-based learnng algorthm, IJNA (2007), Volume 30, Issue 1, January 2007, Pages [40] Abraham, A., Jan, R., Thomas, J., Han, S.Y., D-SCIDS: Dstrbuted soft computng ntruson detecton system, IJNA (2007), Volume 30, Issue 1, January 2007, Pages: [41] Peddabachgar, S., Abraham, A., Grosan, C., Thomas, J., Modelng ntruson detecton system usng hybrd ntellgent systems, IJNA (2007), Volume 30, Issue 1, January 2007, Pages [42] Mao Xe, Song Han, Bmng Tan, Saza Parvn, Anomaly detecton n wreless sensor networks: A survey, IJNA (2011), Volume 34, Issue 4, July 2011, Pages [43] Hoang, X.D., Hu, J., Bertok, P., A program-based anomaly ntruson detecton scheme usng multple detecton engnes and fuzzy nference, IJNA (2009), Volume 32, Issue 6, November 2009, Pages