This paper describes CIDS (Correlation Intrusion Detection System), a novel approach in the detection of DoS attacks that utilizes the change in cross-correlation between selected features. As the DOS attack evolves the cross-correlations rise thus revealing the attack. CIDS relies on changes in correlation magnitude upon shifting from normal to attack conditions, thus it is an anomaly type intrusion detection system (IDS). However it is characterized by several advantages over anomaly IDS, primarily due to the fact that it greatly reduces and/or eliminates the need to maintain normal reference profiles. Thus CIDS (1) is algorithmically simple; (2) consumes less computational and storage resources; (3) is faster in execution; (4) promises to be more robust; and, (5) is conceptually simple, thus promises to be easier to maintain. By detecting abnormal conditions, CIDS also promises to detect novel as well as known attacks, an important advantage over signature based systems. Moreover, it achieves satisfactory misclassification rates, as demonstrated by the application of the scheme to the DARPA'98 corpus of intrusion attacks, namely false positive (FP) and false negative (FN) rates of 0 and 0.0605, respectively, and overall missclassification rate of 0.0011.
Detecting denial-of-service attacks through feature cross-correlation
01.01.2004
268154 byte
Aufsatz (Konferenz)
Elektronische Ressource
Englisch
Assessing and quantifying denial of service attacks
Tema Archiv | 2001
|Counter Mechanisms for Denial of Service Attacks
British Library Conference Proceedings | 2007
|Detecting and Defeating Against Denial-of-Service Attacks on Network Intrusion Detection Systems
British Library Online Contents | 2004
|Payment processers face denial of service attacks
British Library Online Contents | 2005
Denial-of-Service Attacks on C-V2X Networks
TIBKAT | 2021
|