Feedback control in intrusion detection systems

Abstract

Real Time Network-based Intrusion Detection Systems (RT-IDSs) attempt to detect and respond to security violations for information systems in real time, i.e. while they are under deployment. One determinative aspect to consider when designing RT-IDSs is how to keep these IDSs functional under overload attacks. When overload attack happens, the RT-IDS becomes vulnerable to precisely timed malicious access, even if the IDS has corresponding rules capable of detecting the attack. To counteract these attacks, researchers have proposed an adaptive scheme which adjusts the rule portfolio of RT-IDS according to the feedback information from network traffic. In this thesis, the adaptive behaviors of RT-IDS are tested in a software based network test-bed. Feedback information other than network traffic is considered to decide when to configure the rule portfolio of RT-IDS. Different feedback strategies are suggested and implemented in simulation environment and their performances are compared and analyzed.