Hybrid Intrusion Detection System Integrating Anomaly and Signature Detection Methods

The massive data flows carried by current ultra-high-speed networks must be processed to detect and counteract a wide spectrum of intrusions with minimal delays. To address this challenge, this project will develop a novel automated hybrid intrusion detection system that combines anomaly detection with a signature detection system in one unit, and is specifically tailored to ultra-high-speed networks. The proposed system has a cascade, two-stage architecture that exploits change-point detection methods at the first stage and flow-based spectral (Fourier and wavelet) features at the second stage. The system allows for the filtering of false positives and true attack confirmation, thereby achieving unprecedented detection speeds accompanied by a very low false alarm rate. In addition, the system will enable isolation and localization of anomalies produced by attacks, as well as anomalies produced by legitimate traffic changes that require the attention of network operators. A version of this system will be customized and tested on the DOE UltraScience NetCommercial Applications and other Benefits as described by the awardee The hybrid system should have crucial advantages over existing systems, including increased detection probability, a lower false alarm rate, and minimal detection delay. The system should be of particular relevance to DOE networks that support large-scale science applications requiring special networking capabilities