Network Intrusion Detection using Layered Approach and Hidden Markov Model

Traditional intrusion detection systems uses either anomaly based or signature based technique. Both of these techniques have some problems. In anomaly based intrusion detection, the strategy is to suspect an unusual activity and thereby to continue further investigation. This approach is particularly effective against novel attacks. Signature based intrusion detection system detects known attacks timely and efficiently. For this approach, it is important to know the attack. The proposed system introduces a hybrid of anomaly based and signature based technique. The proposed system uses layered approach to get the results faster. Each layer in the layered approach is independent to detect and block an attack. Four different layers Probe, U2R, R2L and DOS are assigned with different features. The proposed hybrid technique with Hidden Markov Model can give better results compared to signature based and anomaly based intrusion detection techniques alone