A Case Study of a Networking Company - INTRUSION DETECTION SYSTEM



1.0     INTRODUCTION       

In today’s inter-connected eCommerce web world you cannot remain hidden for long. You can be found through a wide variety of means: Domain Name Server (DNS) Lookup, NSlookup, Newsgroups, web site trawling, e-mail properties and so on. May the motive be financial gain, intellectual challenge, espionage, political, or simply trouble-making, one is often exposed to a variety of intruder threats. And there is no disputing the facts... the number of hacking and intrusion incidents is increasing day by day. Intrusions are caused by attackers, attacking the systems from the Internet, authorized users of the systems who attempt additional privileges for which they are not authorized, and authorized users misusing the privileges given to them. Obviously it is not just common sense to guard against this, but business imperative as well that you do.

This is where Intrusion Detection Systems come in. Intrusion detection may be defined as the process of monitoring the events occurring in a system or network and analysing them for signs of intrusions, which compromise the confidentiality, integrity, availability, or to bypass the security mechanisms of a computer or network. Intrusion Detection Systems (IDS) are software or hardware products that automate this monitoring and analysis process.

Although many people rely solely on firewalls, for the security of their systems, firewalls only serve as barrier mechanisms, barring entry to some kinds of network traffic and allowing others, based on a firewall policy. INTRUSION DETECTION SYSTEM (IDS) serve as monitoring mechanisms, watching activities, and making decisions about whether the observed events are suspicious. They can spot attackers circumventing firewalls and report them to system administrators, who can take steps to prevent damage. Intrusion detection allows organizations to protect their systems from the threats that come with increasing network connectivity and reliance on information systems. Given the level and nature of modern network security threats, the question for security professionals should not be whether to use intrusion detection, but which intrusion detection features and capabilities to use. There are basically two main types of INTRUSION DETECTION SYSTEM (IDS) being used today: Network based (a packet monitor), and Host based (looking for instance at system logs for evidence of malicious or suspicious application activity in real time).

Intrusion detection functions include:

1. Monitoring and analysing both user and system activities

 2. Analysing system configurations and vulnerabilities

 3. Assessing system and file integrity

 4. Ability to recognize patterns typical of attacks

 5. Analysis of abnormal activity patterns

 6. Tracking user policy violations



Originally, system administrators performed intrusion detection by sitting in front of a console and monitoring user activities. They might detect intrusions by noticing, for example, that a vacationing user is logged in locally or that a seldom-used printer is unusually active. Although effective enough at the time, this early form of intrusion detection was ad hoc and not scalable. The next step in intrusion detection involved audit log which system administrators reviewed for evidence of unusual or malicious behaviour .In the late ’70s and early ’80s, administrators typically printed audit logs on fan-folded paper, which were often stacked four- to five-feet high by the end of an average week. Searching through such a stack was obviously very time consuming. With this overabundance of information and only manual analysis, administrators mainly used audit logs as a forensic tool to determine the cause of a particular security incident after the fact. There was little hope of catching an attack in progress. As storage became cheaper, audit logs moved online and researchers developed programs to analyse the data. However, analysis was slow and often computationally intensive, and, therefore, intrusion detection programs were usually run at night when the system’s user load was low. Therefore, most intrusions were still detected after they occurred. In the early ’90s, researchers developed real-time intrusion detection systems that reviewed audit data as it was produced. This enabled the detection of attacks and attempted attacks as they occurred, which in turn allowed for real-time response, and, in some cases, attack pre-emption.

More recent intrusion detection efforts have centred on developing products that users can effectively deploy in large networks. This is no easy task, given increasing security concerns, countless new attack techniques, and continuous changes in the surrounding computing environment.



The Aim of this work is to detect and block any suspicious and malicious acts in internet environment.


  1. To detect wide variety of intrusions

- Previously known and unknown attacks

- Suggests need to learn and adapt to new attacks or changes in behaviour

  1. Detect intrusions in timely fashion
  • May need to be real-time especially when system responds to intrusion
  1. Problem; analysing command may impact responds time of system
  •  May suffice to report intrusion occurred a few minutes or hours ago.



It is well known that anomaly-based INTRUSION DETECTION SYSTEM (IDS) suffers from the high rate of false alarms. Continuous efforts are being made to reduce the high false positive rate. We believe that intrusion detection is a data analysis process and can be studied as a problem of classifying data correctly.

From this standpoint, it can also be observed that any classification scheme is as good as the data presented to it as input. More clean the data, higher accurate results are likely to be obtained. From anomaly-based INTRUSION DETECTION SYSTEM (IDS) point of view, it implies that if we can extract features that demarcate normal data from abnormal one properly, false positive rate can be reduced to a great extent. Therefore, in this work, we investigate the techniques which facilitate in the process of demarcating normal data from abnormal ones. On the similar lines, we observe that most of the data mining and machine learning based methods in intrusion detection make use of well-known tools and techniques. It may turn out that these general techniques are not very effective in classifying data as normal or abnormal with very high accuracy. There is a need to customize those techniques according to the requirement of intrusion detection. We also focus on this aspect in our work. Apart from the problems mentioned above, the fast detection of attacks remains one of the focal points to be worried about. With the present complexity and variety of attacks, we need a huge amount of data to analyse and produce results. But larger the amount of data, longer the time to analyse it, which delays the detection of attacks. An INTRUSION DETECTION SYSTEM (IDS) will be of more use if it can trigger an alarm early enough to reduce the damage that an ongoing attack can do. Thus, there is a need to make INTRUSION DETECTION SYSTEM (IDS) as fast as to operate on-line. We believe that this can be achieved if we can reduce the data, to be analysed, without degrading its quality. In a nutshell, the present thesis tries to answer the following problem:

How to make the INTRUSION DETECTION SYSTEM (IDS) fast enough to process data on-line and detect attacks early and in case of anomaly-based INTRUSION DETECTION SYSTEM (IDS), how to reduce the false positives to an accepted level, with a high detection rate.



Intrusion detection system is a detective software designed to detect and prevent malicious (including policy-violating) actions. It will also block the malicious acts.