A combined wavelet and auyoregressive based statistical intrusion detection system "the wavelet-AR IDS"

Abstract

Networks are complex interacting systems and are comprised of several individual entities such as routers and switches. Network performance information is not directly available, and the information obtained must be synthesized to obtain an understanding of the ensemble behavior. Threat from un-authorized users and remote attackers is increasing rapidly. There is a need for robust and reliable Intrusion Detection Systems. Common criterions for reliable IDS are low false positive rate and false negative rate, and high true positive rate and true negative rate. If IDS satisfies these criterions then it can be used to provide network security. In this thesis, a new IDS scheme is proposed. Wavelet-AR IDS is designed to satisfy the criterions above. In the design phase the objective was to reduce to Autoregressive based IDS’s false positive rate. The other objective was to design a new A operator matrix in order to increase the detection rate of Intrusion Detection System. The innovation in this thesis is to combine Wavelet and Autoregressive models in order to design a robust and reliable Intrusion Detection System. It is shown that Wavelet-AR IDS has acceptable false alarm rate and false negative rate, and Wavelet-AR IDS has high true positive rate and true negative rate. Consequently, we can say that Wavelet-AR IDS is a good Statistical Intrusion Detection System.