Automatic network intrusion detection: Current techniques and open issues

Abstract

Automatic network intrusion detection has been an important research topic for the last 20 years. In that time, approaches based on signatures describing intrusive behavior have become the de-facto industry standard. Alternatively, other novel techniques have been used for improving automation of the intrusion detection process. In this regard, statistical methods, machine learning and data mining techniques have been proposed arguing higher automation capabilities than signature-based approaches. However, the majority of these novel techniques have never been deployed on real-life scenarios. The fact is that signature-based still is the most widely used strategy for automatic intrusion detection. In the present article we survey the most relevant works in the field of automatic network intrusion detection. In contrast to previous surveys, our analysis considers several features required for truly deploying each one of the reviewed approaches. This wider perspective can help us to identify the possible causes behind the lack of acceptance of novel techniques by network security experts.

Introduction

A network intrusion detection system (NIDS) is the software tool that automates the network intrusion detection process. From an architectural point of view a NIDS can be analyzed from several angles (i.e. traffic capture process, system location, appropriate measures selection, among others). However, from a more simplified point of view, intrusion detection can be seen just as a classification problem in which a given network traffic event is assigned as normal or intrusive.

In the past 20 years, several techniques have been proposed to address the embedded classification problem inside NIDS. Perhaps the most successful approach has been the one based on pattern signatures describing known attacks behavior [1]. Under this approach, a malicious event is detected when some monitored event matches against a signature pattern. Despite signature-based NIDS are considered the de facto standard, they face the problem of needing a new set of signature patterns each time a new attack emerges. In addition, signatures describing such attacks have to be written by experts, which are not always available. In other words, the signature-based approach has failed in providing the level of automation required by security staff members.

Alternatively, techniques including statistical methods, machine learning and data mining methods have been proposed as a way of dealing with some of the issues regarding signature based-approaches. Such techniques aim at facilitating the work of the network security staff, providing a higher automation in the intrusion detection process along with good detection capabilities. Despite the success in obtaining high accuracy levels, most of these techniques have actually not been deployed in real-life scenarios. This situation suggests that accuracy is not the only goal in the pursuit of automatic intrusion detection.

The present work reviews the most relevant network intrusion detection techniques for wired networks, putting special emphasis on the embedded classification problem. However, in opposition to previous surveys on this field, analysis is performed considering not only accuracy results but also other features required for implementing the discussed techniques in real-life scenarios.

The rest of this work is organized as follows: Section 2 provides background information about the intrusion detection problem, including attack definitions, a taxonomy and a simplified NIDS architecture. Then, in Section 3, the most relevant approaches applied to intrusion detection are reviewed and compared based on the taxonomy along with common measures related to NIDS. Section 4 remarks the remaining open issues, which aim to explain why all except the signature-based approach are not being deployed on current networks. Finally, concluding remarks are provided in Section 5.