A Flow-Based Network Intrusion Detection System for High-Speed Networks Using Meta-heuristic Scale

Abstract

Internet users are drastically increasing, along with new network services which are leading to more serious network attacks and threats. A network intrusion detection system (NIDS) is designed mainly to detect such attacks. While some NIDSs work by inspecting the complete traffic called as packet-based NIDSs, other NIDSs inspect cumulative information related to the packets in the form of flow called as flow-based NIDSs. Even though packet-based NIDSs generate high detection accuracy with low false alarms, they are hard, or even impossible, to achieve at the speed. In the flow-based IDSs, the amount of information to be processed is lesser, so it is the logic suitable for high-speed networks. But the problem is with flow-based high false alarm rate and low accuracy. In this paper, a flow-based intrusion detection system (IDS) for high-speed networks using meta-heuristic scale is proposed. Initially, a flow-based approach is applied on request stream to define feature metrics. Next, these feature metrics are used to define the scale, which is further used to define whether the flow is normal or malicious. In order to confirm the effectiveness of the model proposed, it has been experimented on NSL-KDD. The experimental results exhibit that the designed models provide improved accuracy with less computational time and minimal false alarm rate.