Hybrid Distributed Intrusion Detection System - Ujeniya, A.A; Pawar, R.D; Sonawane, S.A; Shingade, S.B; Khonde, S.R (International Journal of Computer Sciences and Engineering, 2018)
There is rise in new Intrusion Detection Systems (IDSs) due to increasing frequency of various malicious activities over network and certain network policy violations. IDS, being an advanced tool and equipment to secure the network parameter by surveillance from the different network risks, is capable of detecting various attacks due to advancements in Computer Science. These advancements include machine learning models which can be integrated into an IDS for increasing the Detection Rate of attacks and minimizing the False Alarm Rate (false positives). In this paper, Hybrid Distributed IDS (HDIDS) is proposed in which strengths of Signature-based and Anomaly-based detection are combined together to detect different types of Denial of Service (DoS) attacks. HDIDS is presented by combining an anomaly-based detection algorithm and multiple signature-based detection algorithms. The signature-based multiple classifiers ensemble and can detect real time attack based on majority of votes from each classifier. Ensembled output use voting technique which are simplest to implement and produce favourable results. Anomaly based classifier has intensive focus over new and unknown attacks in distributed network. The dataset used for training the classifiers is ISCX CICIDS-17 consisting of latest attacks and 88 features providing better options for feature selection with respect to each classifier.