Testing Ensembles for Intrusion Detection: On the Identification of Mutated Network Scans

Abstract

Abstract. In last decades there have been many proposals from the machine learning community in the intrusion detection field. One of the main problems that Intrusion Detection Systems (IDSs) -mainly anomaly-based ones -have to face are those attacks not previously seen (zero-day attacks). This paper proposes a mutation technique to test and evaluate the performance of several classifier ensembles incorporated to network-based IDSs when tackling the task of recognizing such attacks. The technique applies mutant operators that randomly modifies the features of the captured packets to generate situations that otherwise could not be provided to learning IDSs. As an example application for the proposed testing model, it has been specially applied to the identification of network scans and related mutations.

An Ensemble Classification Approach for Intrusion Detection

“…Bahri et al introduced a novel method based on boosting technique which was an adaptation of Adaboost [12]. Recently, there are many papers published regarding ensemble approaches [13] [14]. Performance evaluation of a distributed system of ensemble known as GEdIDS was done by Folino et al [15][16].…”