Summary
In this paper we propose anomaly detection preprocessor for SNORT IDS Intrusion Detection System [1] base on probabilistic and signal processing algorithms working in parallel. Two different algorithms increasing probability of detecting anomalies in network traffic. 25 network traffic features were used by preprocessor for detecting anomalies. Preprocessor calculated Chi-square statistic test and energy from DWT Discrete Wavelet Transform subband coefficients. Usability of proposed SNORT extension was evaluated in local LAN network.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
SNORT IDS, http://www.snort.org/
Ye, N., Chen, Q., Emran, S.M.: Chi-squared statistical profiling for anomaly detection. In: Proc. IEEE SMC Inform. Assurance Security Workshop, West Point, pp. 182–188 (2000)
Scherrer, A., Larrieu, N., Owezarski, P., Borgant, P., Abry, P.: Non-Gaussian and Long Memory Statistical Characterizations for Internet Traffic with Anomalies. IEEE Trans. on Dependable and Secure Computing 4(1) (2007)
Choraś, M., Saganowski, Ł., Renk, R., Hołubowicz, W.: Statistical and signal-based network traffic recognition for anomaly detection. Expert Systems: The Journal of Knowledge Engineering (2011), doi:10.1111/j.1468-0394.2010.00576.x
Ye, N., Li, X., Chen, Q., Masum Emran, S., Xu, M.: Probabilistic techniques for intrusion detection based on computer audit data. IEEE Trans. on Systems, Man and Cybernetics-Part A: Systems and Humans 31(4) (2001)
Dainotti, A., Pescape, A., Ventre, G.: Wavelet-based Detection of DoS Attacks. In: IEEE GLOBECOM, San Francisco, CA, USA (November 2006)
Wei, L., Ghorbani, A.: Network Anomaly Detection Based on Wavelet Analysis. EURASIP Journal on Advances in Signal Processing, Article ID 837601, 16 pages (2009), doi:10.1155/2009/837601
Grossman, A., Morlet, J.: Decompositions of Functions into Wavelets of Constant Shape, and Related Transforms. Mathematics and Physics: Lectures an Recent Results, L. Streit (1985)
Sweldens, W.: The Lifting Scheme: A Custom-Design Construction of Biorthogonal Wavelets. Applied and Computational Harmonic Analysis 3(15), 186–200 (1996)
Lakhina, A., Crovella, M., Diot, C.H.: Characterization of network-wide anomalies in traffic flows. In: Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, pp. 201–206 (2004)
BackTrack Linux, http://www.backtrack-linux.org/
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Saganowski, Ł., Goncerzewicz, M., Andrysiak, T. (2013). Anomaly Detection Preprocessor for SNORT IDS System. In: Choraś, R. (eds) Image Processing and Communications Challenges 4. Advances in Intelligent Systems and Computing, vol 184. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-32384-3_28
Download citation
DOI: https://doi.org/10.1007/978-3-642-32384-3_28
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-32383-6
Online ISBN: 978-3-642-32384-3
eBook Packages: EngineeringEngineering (R0)