Using Approximation of Standard Deviation and Variance in Flow Features for Efficient Intrusion Detection

Intrusion Detection Systems (IDS) are one of the most important defense tools against dangerous and sophisticated network attacks. In recent years high-speed network interfaces have become common in data centers and servers. To process such high-speed network traffic entirely, the feature extraction phase of an IDS must be highly efficient. The speed and overall efficiency of the feature extraction phase of anomaly-based Intrusion Detection Systems can be improved by substituting the exact values for standard deviation and variance with lower complexity approximations. This paper demonstrates that using range rule of thumb approximations instead of exact values does not affect the classification results of the model tested in its various configurations. The results show that the accuracy of the model output obtained using the approximations does not differ from the results obtained using the real values by more than 0.05%.