Network intrusion detection using CFAR abrupt-change detectors

IEEE Transactions on Instrumentation and Measurement

Volumn 57, Issue 3, 2008, Pages 490-497

  He, Di ^a   Leung, Henry ^b  

^a SHANGHAI JIAO TONG UNIVERSITY   (China)

^b UNIVERSITY OF CALGARY   (Canada)

Author keywords

Cell averaging (CA CFAR); Constant false alarm rate (CFAR); Dempster Shafer; Detector fusion; Intrusion detection; Network traffic model; Optimal CFAR; Order statistics CFAR (OS CFAR)

Indexed keywords

BAYESIAN NETWORKS; COMPUTER SIMULATION; DATA FUSION; GAUSSIAN DISTRIBUTION; TELECOMMUNICATION TRAFFIC;

CONSTANT FALSE ALARM RATE; DEMPSTER-SHAFER; NETWORK TRAFFIC MODEL;

INTRUSION DETECTION;

EID: 40549108657     PISSN: 00189456     EISSN: None     Source Type: Journal    
DOI: 10.1109/TIM.2007.910108     Document Type: Article

References (26)

1. R. A. Kemmerer and G. Vigna, "Intrusion detection: A brief history and review," Computer, vol. 35, no. 4, pp. 27-30, Apr. 2002.
2. B. Mukherjee, L. T. Heberlein, and K. N. Levitt, "Network intrusion detection," IEEE Netw., vol. 8, no. 3, pp. 26-41, May/Jun. 1994.
3. J. McHugh, A. Christie, and J. Allen, "Defending yourself: The role of intrusion detection systems," IEEE Softw., vol. 17, no. 5, pp. 42-51, Sep./Oct. 2000.
4. C. Herringshaw, "Detecting attacks on networks," Computer, vol. 30, no. 12, pp. 16-17, Dec. 1997.
5. F. Esponda, S. Forrest, and P. Helman, "A formal framework for positive and negative detection schemes," IEEE Trans. Syst., Man, Cybern. B, Cybern., vol. 34, no. 1, pp. 357-373, Feb. 2004.
6. A. P. Kosoresow and S. A. Hofmeyer, "Intrusion detection via system call traces," IEEE Softw., vol. 14, no. 5, pp. 35-42, Sep./Oct. 1997.
7. R. F. Erbacher, K. L. Walker, and D. A. Frincke, "Intrusion and misuse detection in large-scale systems," IEEE Comput. Graph. Appl., vol. 22, no. 1, pp. 38-47, Jan./Feb. 2002.
8. K. Ilgun, R. A. Kemmerer, and P. A. Porras, "State transition analysis: A rule-based intrusion detection approach," IEEE Trans. Softw. Eng. vol. 21, no. 3, pp. 181-199, Mar. 1995.
9. S. P. Shieh and V. D. Gligor, "On a pattern-oriented model for intrusion detection," IEEE Trans. Knowl. Data Eng., vol. 9, no. 4, pp. 661-667, Jul./Aug. 1997.
10. N. Ye, X. Y. Li, Q. Chen, S. M. Emran, and M. M. Xu, "Probabilistic techniques for intrusion detection based on computer audit data," IEEE Trans. Syst., Man, Cybern. A, Syst., Humans, vol. 31, no. 4, pp. 266-274, Jul. 2001.
11. S. B. Cho, "Incorporating soft computing techniques into a probabilistic intrusion detection system," IEEE Trans. Syst., Man, Cybern. C, Appl. Rev., vol. 32, no. 2, pp. 154-160, May 2002.
12. K. M. C. Tan and R. A. Maxion, "Determining the operational limits of an anomaly-based intrusion detector," IEEE J. Sel. Areas Commun., vol. 21, no. 1, pp. 96-110, Jan. 2003.
13. Y. Qiao, X. W. Xin, Y. Bin, and S. Ge, "Anomaly intrusion detection method based on HMM," Electron. Lett., vol. 38, no. 13, pp. 663-664, Jun. 2002.
14. S. C. Lee and D. V. Heinbuch, "Training a neural-network based intrusion detector to recognize novel attacks," IEEE Trans. Syst., Man, Cybern. A, Syst., Humans, vol. 31, no. 4, pp. 294-299, Jul. 2001.
15. T. Ryutov, C. Neuman, K. Dongho, and Z. Li, "Integrated access control and intrusion detection for Web servers," IEEE Trans. Parallel Distrib. Syst., vol. 14, no. 9, pp. 841-850, Sep. 2003.
16. C. L. Nelson and D. S. Fitzgerald, "Sensor fusion for intelligent alarm analysis," IEEE Aerosp. Electron. Syst. Mag., vol. 12, no. 9, pp. 18-24, Sep. 1997.
17. A. Adas, "Traffic models in broadband networks," IEEE Commun. Mag. vol. 35, no. 7, pp. 82-89, Jul. 1997.
18. N. Ye, Y. B. Zhang, and C. M. Borror, "Robustness of the Markov-chain model for cyber-attack detection," IEEE Trans. Rel., vol. 53, no. 1, pp. 116-123, Mar. 2004.
19. Z. Sahinoglu and S. Tekinay, "On multimedia networks: Self-similar traffic and network performance," IEEE Commun. Mag., vol. 37, no. 1, pp. 48-52, Jan. 1999.
20. D. R. Liu, E. I. Sara, and W. Sun, "Nested auto-regressive processes for MPEG-encoded video traffic modeling," IEEE Trans. Circuits Syst. Video Technol., vol. 11, no. 2, pp. 169-183, Feb. 2001.
21. M. Shor and N. Levanon, "Performances of order statistics CFAR," IEEE Trans. Aerosp. Electron. Syst., vol. 27, no. 2, pp. 214-224, Mar. 1991.
22. M. Barkat and F. Soltani, "Cell-averaging CFAR detection in compound clutter with spatially correlated texture and speckle," Proc. Inst. Electr. Eng. - Radar, Sonar Navig., vol. 146, no. 6, pp. 279-284, Dec. 1999.
23. V. Anastassopoulos and G. A. Lampropoulos, "Optimal CFAR detection in Weibull clutter," IEEE Trans. Aerosp. Electron. Syst., vol. 31, no. 1, pp. 52-64, Jan. 1995.
24. F. Gustafsson, Adaptive Filtering and Change Detection. Hoboken, NJ: Wiley, 2000.
25. D. M. Buede and P. Girardi, "A target identification comparison of Bayesian and Dempster-Shafer multisensor fusion," IEEE Trans. Syst., Man, Cybern. A, Syst., Humans, vol. 27, no. 5, pp. 569-577, Sep. 1997.
26. H. Leung and J. Wu, "Bayesian and Dempster-Shafer target identification for radar surveillance," IEEE Trans. Aerosp. Electron. Syst., vol. 36, no. 4, pp. 432-446, Apr. 2000.