Intrusion Detection using Sequential Hybrid Model

TL;DR

This paper proposes a sequential hybrid model for network intrusion detection that combines multiple anomaly detection methods with misuse detection to improve accuracy and reduce false positives.

Contribution

It introduces a novel sequential approach that applies two anomaly detection models followed by misuse detection for enhanced intrusion verification.

Findings

High accuracy in intrusion detection

Effective reduction of false positives

Successful classification of intrusions

Abstract

A large amount of work has been done on the KDD 99 dataset, most of which includes the use of a hybrid anomaly and misuse detection model done in parallel with each other. In order to further classify the intrusions, our approach to network intrusion detection includes use of two different anomaly detection models followed by misuse detection applied on the combined output obtained from the previous step. The end goal of this is to verify the anomalies detected by the anomaly detection algorithm and clarify whether they are actually intrusions or random outliers from the trained normal (and thus to try and reduce the number of false positives). We aim to detect a pattern in this novel intrusion technique itself, and not the handling of such intrusions. The intrusions were detected to a very high degree of accuracy.