Performance improvement of intrusion detection with fusion of multiple sensors

Abstract

Intrusion detection has become a challenging task with the rapid growth in numbers of computer users. The present-day technology requires an efficient method to detect intrusion in the computer network system. Intrusion detection system is a classifier which collects evidences for the presence of intrusion and raises an alarm for any abnormalities present. However, the use of intrusion detection system encounters two major drawbacks: higher false alarm rate and lower detection rate; these limit the detection performance of intrusion detection system. A prospective approach for improving performance is through the use of multiple sensors/intrusion detection system. Evidence theory is a mathematical theory of evidence which is used to fuse evidences from multiple sources of evidence and outputs a global decision. The work in this paper discusses the limitations and issues with evidence theory and proposes a modified framework for fusion of alarms of multiple intrusion detection systems.