Intrusion Detection Essay

APPLICATION OF ANOMALY DETECTION

1) Intrusion Detection

Intrusion detection refers to detection of malicious activity (break-ins, penetrations, and other forms of computer abuse) in a computer related system [Phoha 2002]. An intrusion indicates the presence of unwanted activities in computer network. The challenges to intrusion detection are the need of more efficient anomaly detection techniques to handle huge volume of data and streaming data of networks.

Two types of intrusion detection systems into host-based and network based intrusion detection systems.

Host Based Intrusion detection: Such systems (also referred to as system call intrusion detection systems) handle the operating system call traces. Collective anomalies are the major types of anomalies detected in such systems. The anomalous events may refer to malicious programs, unauthorized behaviour, data stealing, policy violations, virus attacks.

Network Intrusion Detection Systems: In this the anomalous intrusions in network data are identified in the form of collective or point anomalies. These systems deal with detecting intrusions in network data. Outside attackers or spammers are responsible for such attacks who aim to gain unauthorised access to network information to either disable network or steal confidential information.

A major

They try to steal the identity of the genuine customers in various malicious ways and try to use their resources in unauthorized way. Thus, the organisations wants systems to detect such frauds to stop the economic losses they suffer and the customers trust is also at stake. The basic approach of anomaly detection techniques is to maintain a customer’s profile and monitor the profiles to detect any unexpected behaviour or deviations. Under this category comes following