Effective Hybrid Intrusion Detection System: A Layered Approach

Abstract

—Although there are different techniques proposed for intrusion detection in the literature, most of them consider standalone misuse or anomaly intrusion detection systems. However, by taking the advantages of both systems a better hybrid intrusion detection system can be developed. In this paper, we present an effective hybrid layered intrusion detection system for detecting both previously known and zero-day attacks. In particular, a two layer system that combines misuse and anomaly intrusion detection systems is proposed. The first layer consists of misuse detector which can detect and block known attacks and the second layer comprises of anomaly detector which can efficiently detect and block previously unknown attacks. The misuse detector is modeled based on random forests classifier and the anomaly detector is built using bagging technique with ensemble of one-class support vector machine classifiers. Data pre-processing is done using automatic feature selection and data normalization. Experimental results show that the proposed intrusion detection system outperforms other well-known intrusion detection systems in detecting both previously known and zero-day attacks.