Survey of Current Network Intrusion Detection Techniques

Abstract:

The importance of network security has grown tremendously and a number of devices have been introduced to improve the security of a network. Network intrusion detection systems (NIDS) are among the most widely deployed such system. Popular NIDS use a collection of signatures of known security threats and viruses, which are used to scan each packet's payload. Signature based designs have low false positive rates, and they are effective and accurate in combating against the known security threats. However, they remain completely ineffective against those attacks that are yet unknown; these can be combated only after they are detected manually and a signature is created for them.

Since new threats are potentially more lethal, a number of pro-active designs have been proposed, which can detect new security events such as propagation of a new and unknown virus or worm. Such systems accomplish this by creating a profile of normal Internet traffic, and then using this profile to continuously monitor the network activity for suspicious activity. As the system senses an anomaly, or a dramatic change in traffic characteristics, it takes certain actions such as raising an alarm or discarding certain traffic. In this Survey paper, we will evaluate a number of current NIDS systems and the algorithms they employ to detect and combat security threats, both from technical and economical perspective.

Keywords:

NIDS, Anomaly Detection, Network Security, Security Signature, Pattern Matching

Table of Contents

• 1. Introduction
• 2. NIDS and Network Architecture
• • 2.1 Early Warning Mode
  • 2.2 Internal Deployments
  • 2.3 NIDS within Every Host (like an anti-virus)
• 3. Signature Based NIDS
• • 3.1 Aho-Corasick Algorithm
  • 3.2 Regular Expressions Signatures
  • 3.2 Architecture of Signature based NIDS
• 4. Anomaly Detection based NIDS
• • 4.1 Statistical Anomaly Detection
  • 4.2 Machine Learning to Detect Anomalies
  • 4.3 Data Mining Algorithms to Detect Anomalies
• 5. Strengths and Limitations of NIDS
• • 5.1 Strengths of NIDS
  • 5.2 Limitations of NIDS
• 6. Common Attacks and Vulnerabilities and Role of NIDS
• • 6.1 Attack Types
  • 6.2 Attacks detected by a NIDS
  • • 6.2.1 Scanning Attack
    • 6.2.2 Denial of Service (DoS) Attacks
    • 6.2.3 Penetration Attacks
  • 6.3 Role of NIDS in Combating Attacks
  • • 6.3.1 Excessive Attack Reporting
  • 6.4 Computer Vulnerabilities and NIDS
  • • 6.4.1 Buffer overflow
    • 6.4.2 Input Validation Error
    • 6.4.3 Boundary Condition Error
    • 6.4.4 Access Control Vulnerability
• • 7. Future of NIDS
  • 8. Summarizing NIDS
  • References
  • List of Acronyms

View the complete report online

Shift-click to download the paper in Adobe Acrobat format