Anomaly Detection Using Context-Based Intrusion Detection System

Abstract- Intrusion Detection System(IDS) is a software or device which checks the network or the host for tasks which may be harmful or tasks which violate policies of the system or the network. The intrusion can be signature based or anomaly based. This paper is regarding the anomaly based approach. In the anomaly based approach, the IDS studies the regular activities of the system and prepares a normal profile of the system. Anything which varies from the normal recorded profile is considered as an attack. Intrusions can come through the network or through the host itself. We have used the 10 % KDD CUP ’99 Labelled Data set for studying the normal profile during the training phase. Then we have used a data set without the labels in the testing phase for checking the anomalies. For determining the nature of a data packet, we have found the Euclidean distance from the threshold for each and then decided the nature of each packet from that. We have used the context-based intrusion detection in the implementation i.e all the data is not included in a single global profile, but there are separate profiles for separate contexts. Studies have shown that the accuracy rate of context-based profiling is much better than global-profiling and the false alarm rates are also much lower, as in the global profile various types of activities fall under a single profile leading to higher false alarms