Implementation Hybrid (NIDS) System using Anomaly Holtwinter Algorithm and Signature based Scheme

Abstract

An intrusion detection system is a security attack detection/prevention mechanism, it can be implemented into the software module or hardware module for the purpose of monitoring the systems or network for malicious activities. IDS can be categorized by monitoring resources to Host Intrusion Detection System (HIDS) and Network Intrusion Detection System (NIDS). HIDS are deployed to monitor local activities on the specific machine; on the other hand, NIDS placed into the central point on the network such as firewall to monitor network traffic. IDS also can be categorized depending on the detection method for anomaly and misuse (signature).In this paper, we implement a hybrid implementation of IDS using Holt-winter anomaly algorithm and signature-based approach. Furthermore, a case study using Holt-winter anomaly based and signature misuse based schemes will be implemented and analyzed, finally, the result of the experiment will be shown.

Comparison of Software and Hardware Based Intrusion Prevention Systems

“…IPSs are similar to antivirus software in that they use known signatures to distinguish malicious traffic patterns. IPSs fundamentally consists of 5 modules as shown in Figure 2 [11]. The packet decoder captures packets from different interfaces, protocols and services on the network and makes them ready to be sent to the preprocessor.…”

“…Interfaces can be Serial Line Internet Protocol, Ethernet, Point-to-Point Protocol, and similar protocols [12]. After the packets are passed from the packet decoder to the preprocessor, the preprocessor identifies the data packets according to density and IPS rules and forwards them to the next component which is the detection engine [11]. The detection engine receives the packets from the preprocessor and checks them through a set of rules.…”

“…Depending on how the output is intended to be saved, it can perform different actions generated by the log and alert system. This module can also control the type of output produced by the log and alert system [11].…”