A Threat-Aware Anomaly-Based Intrusion-Detection Approach for Obtaining Network-Specific Useful Alarms

Abstract

We present a model and architecture that enhance anomaly based intrusion detection system(IDS) with threat-awareness capability. Anomaly based network IDS, profile network traffic to arrive base-line based on which it identifies anomalous events. However, due to dynamic changes in the threat level of a network, only a subset of these identified events are relevant to the network at any given instance. Hence, we introduce the notion of Threat-Awareness for anomaly based network IDS that periodically learns the changing threats in a network and enhance the capability of traditional anomaly based IDS to obtain network specific useful alarms. In this paper, we present a Threat-Aware Anomaly-Based IDS model for obtaining network-specific useful alarms. We also present our architecture and discuss its internal functions. Finally, we present our experiments based on various threat scenarios and the results obtained proves the efficiency of our model.