Enhancing Intrusion Detection System with proximity information

  • Authors:

  • Zhenyun Zhuang;Ying Li;Zesheng Chen

  • Affiliations:

  • College of Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA.;College of Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA.;Department of Engineering, Indiana University – Purdue University Fort Wayne, Fort Wayne, IN 46805, USA

  • Venue:
  • International Journal of Security and Networks
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Intrusion Detection Systems (IDSes) proposed to identify or prevent the wide spread of worms can be largely classified as signature-based or anomaly-based. Modern worms are often sufficiently intelligent to hide their activities and evade anomaly detection, rendering existing IDSes (particularly signature-based) less effective. We propose PAIDS, a proximity-assisted IDS approach for identifying the outbreak of unknown worms. Operating on an orthogonal dimension with existing IDSes, PAIDS can work collaboratively with existing IDSes for better performance. Trace-driven evaluation indicates that PAIDS has high detection rates and low false-positive rates. We also build a prototype with Google Maps APIs and libpcap library.