{"title":"通过将大量数据流转换为IDS的连续连接来增强网络安全性","authors":"Maher Salem, Ulrich Bühler","doi":"10.1109/ICITST.2013.6750267","DOIUrl":null,"url":null,"abstract":"Processing massive data flow in intrusion detection systems (IDS) become a serious challenge. It is considered as a major deficiency while handling heterogeneous and non-stationary data stream to uncover anomaly in the online operational mode. This paper proposes a novel online method that constructs connections from the massive data flow for evaluating IDS models. The proposed method overcomes this challenge by using a queuing concept of dynamic window size. It captures network traffic and hosts events constantly and handles them synchronously within time slot windows inside the queue in order to construct connection vectors based on certain features. We have evaluated the method in offline mode using DARPA dump data flow and in online mode using a simulated network at the university campus. In addition, we have evaluated our IDS model using the constructed connections to proof the feasibility and plausibility of the proposed method in IDS area. The performance evaluation confirms that, the proposed method is able to operate in offline as well online modes efficiently. Moreover, constructed connections are very adequate for training and evaluating IDS models.","PeriodicalId":246884,"journal":{"name":"8th International Conference for Internet Technology and Secured Transactions (ICITST-2013)","volume":"18 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2013-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"1","resultStr":"{\"title\":\"Reinforcing network security by converting massive data flow to continuous connections for IDS\",\"authors\":\"Maher Salem, Ulrich Bühler\",\"doi\":\"10.1109/ICITST.2013.6750267\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"Processing massive data flow in intrusion detection systems (IDS) become a serious challenge. It is considered as a major deficiency while handling heterogeneous and non-stationary data stream to uncover anomaly in the online operational mode. This paper proposes a novel online method that constructs connections from the massive data flow for evaluating IDS models. The proposed method overcomes this challenge by using a queuing concept of dynamic window size. It captures network traffic and hosts events constantly and handles them synchronously within time slot windows inside the queue in order to construct connection vectors based on certain features. We have evaluated the method in offline mode using DARPA dump data flow and in online mode using a simulated network at the university campus. In addition, we have evaluated our IDS model using the constructed connections to proof the feasibility and plausibility of the proposed method in IDS area. The performance evaluation confirms that, the proposed method is able to operate in offline as well online modes efficiently. Moreover, constructed connections are very adequate for training and evaluating IDS models.\",\"PeriodicalId\":246884,\"journal\":{\"name\":\"8th International Conference for Internet Technology and Secured Transactions (ICITST-2013)\",\"volume\":\"18 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2013-12-01\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"1\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"8th International Conference for Internet Technology and Secured Transactions (ICITST-2013)\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1109/ICITST.2013.6750267\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"8th International Conference for Internet Technology and Secured Transactions (ICITST-2013)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ICITST.2013.6750267","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
Reinforcing network security by converting massive data flow to continuous connections for IDS
Processing massive data flow in intrusion detection systems (IDS) become a serious challenge. It is considered as a major deficiency while handling heterogeneous and non-stationary data stream to uncover anomaly in the online operational mode. This paper proposes a novel online method that constructs connections from the massive data flow for evaluating IDS models. The proposed method overcomes this challenge by using a queuing concept of dynamic window size. It captures network traffic and hosts events constantly and handles them synchronously within time slot windows inside the queue in order to construct connection vectors based on certain features. We have evaluated the method in offline mode using DARPA dump data flow and in online mode using a simulated network at the university campus. In addition, we have evaluated our IDS model using the constructed connections to proof the feasibility and plausibility of the proposed method in IDS area. The performance evaluation confirms that, the proposed method is able to operate in offline as well online modes efficiently. Moreover, constructed connections are very adequate for training and evaluating IDS models.