Comparative Analysis of Statistical Models for Anomaly-Based Intrusion Detection Systems: Mean and Standard Deviation Versus Outliers

Abstract

Security has become a critical concern for the networks of companies and institutions today, with numerous intrusion attempts aiming to successfully access their data and web services. The researchers proposed a number of techniques such as (firewall, encryption) to prevent such penetration and protect the infrastructure of computers and networks from possible threats, intrusion detection systems (IDS) has taken much of the attention of researchers, IDS monitors the resources computer and sends reports on the activities of any anomaly or strange patterns. The goal of IDS is to monitor network assets to detect anomalous behavior and misuse in network to reduce the risk. An IDS is a software tool or device designed to monitor a system or network for any policy violations or malicious activities, generating reports for the management system. The primary role of IDS is to identify potential incidents, log relevant information, and report any attempts. IDS has become a vital part of the security infrastructure in most organizations. Various techniques can be employed to detect intrusions, with each being tailored to a specific detection method. The main objective of an IDS is to efficiently detect attacks, with early-stage detection being crucial to minimize the impact of potential threats. Anomaly-based intrusion detection systems (AIDS) rely on statistical models to detect deviations from typical network traffic volume (NTV) and CPU usage. Two prominent statistical approaches include the use of mean and standard deviation for anomaly detection, and outliers for refining the detection process. This article compares these two approaches, focusing on their ability to detect anomalies in network traffic while minimizing the false positive rate and computational power. Our analysis reveals that although both models offer significant insights, the outliers model demonstrates superior performance in reducing false positives and computational power. The experimental results demonstrated that the proposed outlier-based method achieved lower false positive rates and better computational efficiency compared with the traditional mean and standard deviation approach, while maintaining effective anomaly detection performance in different traffic conditions. Unlike traditional statistical techniques that depend strongly on distribution assumptions, the proposed outlier-based approach focuses directly on identifying rare and abnormal traffic behavior. This allows the proposed framework to improve anomaly detection performance while reducing unnecessary false alarms and maintaining low computational complexity.