Survey on Classification Techniques Applied to Intrusion Detection System and its Comparative Analysis

Abstract

Network security is the process of preventing and protecting against unauthorized access from the Internet. Intrusion detection is a basic part of security tools e.g., intrusion detection systems, adaptive security appliances, firewalls and intrusion prevention systems. There are several types of intrusion Detection System (IDS) exists e.g. Network IDS (NIDS), Host IDS, signature-based IDS, Anomaly based IDS. As huge amount of information in the form of packet flow across network may contains vulnerable information which lead to security threats. Many standard IDS datasets are available for researchers to measure their attack type detection/classification method's performance. In this paper we have done survey on classification methods applied on KDD99 and NSL-KDD. Most of the existing work focused on performance of classifier based on time and overall accuracy. we have shown the results of these papers to do collective study. The detection rate of majority classes (DoS and Probe) are good but not the same case with minority classes (U2R and R2L) when base classifier are used alone. It has been studied that there is as improvement in minority classes detection rate with pre-processing or hybrid classifier. By doing comparative study on results given by existing research papers shows that ABC-AFS [25] perform best among all.