Using the pattern-of-life in networks to improve the effectiveness of intrusion detection systems
conference contributionposted on 2018-01-05, 11:12 authored by Francisco J. Aparicio-Navarro, Jonathon Chambers, Kostas KyriakopoulosKostas Kyriakopoulos, Yu GongYu Gong, David J. Parish
© 2017 IEEE. As the complexity of cyber-attacks keeps increasing, new and more robust detection mechanisms need to be developed. The next generation of Intrusion Detection Systems (IDSs) should be able to adapt their detection characteristics based not only on the measureable network traffic, but also on the available highlevel information related to the protected network to improve their detection results. We make use of the Pattern-of-Life (PoL) of a network as the main source of high-level information, which is correlated with the time of the day and the usage of the network resources. We propose the use of a Fuzzy Cognitive Map (FCM) to incorporate the PoL into the detection process. The main aim of this work is to evidence the improved the detection performance of an IDS using an FCM to leverage on network related contextual information. The results that we present verify that the proposed method improves the effectiveness of our IDS by reducing the total number of false alarms; providing an improvement of 9.68% when all the considered metrics are combined and a peak improvement of up to 35.64%, depending on particular metric combination.
This work was supported by the Engineering and Physical Sciences Research Council (EPSRC) Grant number EP/K014307/2 and the MOD University Defence Research Collaboration in Signal Processing.
- Mechanical, Electrical and Manufacturing Engineering
Published inIEEE International Conference on Communications (ICC) 2017 IEEE International Conference on Communications
CitationAPARICIO-NAVARRO, F.J. ...et al., 2017. Using the pattern-of-life in networks to improve the effectiveness of intrusion detection systems. Presented at the IEEE International Conference on Communications (ICC) 2017, Paris, France, 21-25th May.
Publisher© Institute of Electrical and Electronics Engineers (IEEE)
- AM (Accepted Manuscript)
Publisher statementThis work is made available according to the conditions of the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0) licence. Full details of this licence are available at: https://creativecommons.org/licenses/by-nc-nd/4.0/
NotesPersonal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.