Intelligent Intrusion Detection Systems

Question 1

What are the types of IDS?

Answer 1

Host
Network
Hypervisor
Application
Protocol
Server

Question 2

How does host based IDS work?

Answer 2

Monitor resource utilisation and audit trails of specific servers or devices.

Question 3

How does network based IDS work?

Answer 3

Monitor and analyse traffic flows on the network

Question 4

How do application based IDS work?

Answer 4

Separate IDS for different resources IE: Email and web

Question 5

How do protocol based IDS work?

Answer 5

Protocols grouped together, such as those based used in web communications

Question 6

How do server based IDS work?

Answer 6

Subnets or server groups share an IDS

Question 7

What are the methods of IDS?

Answer 7

Misuse based
Anomaly based
Classification Based
Combination Based

Question 8

How do Misuse based IDS work?

Answer 8

Look at patterns, signature definitions etc.

Question 9

How do Anomaly based IDS work?

Answer 9

Statistical, machine learning or data mining approaches.

Use baselines and checks for deviations

Question 10

How do classification based IDS work?

Answer 10

Binary or multi-classification: Decision trees, Bayes, K nearest Neighbour.

Limited in that these require pre-phase of labelling.

Question 11

How do combination based IDS work?

Answer 11

Utilise the best of each technique but suffer from high computational costs.

Question 12

What are data stream methods and what are its benefits?

Answer 12

Used to build models from big datasets

Don’t suffer from the concept or feature drift of batch streaming.

Question 13

What is concept drift?

Answer 13

When a data distribution varies over time and describes the nature of network traffic

Question 14

What is feature drift?

Answer 14

When features change over time as changes in data patterns dictate different levels of features.

Question 15

What are the issues with current IDS datasets?

Answer 15

They are outdated by around 20 years as much of the research is still being done against DARPA and KDD datasets.

Question 16

What are the common issues of datasets?

Answer 16

Some pre-proccessing is necessary to clean the data and transform it for training.

Question 17

What are the issues of class balancing?

Answer 17

Labels are applied to packet and in some datasets the attack labels make up a small portion of the dataset.

This leads to some models favouring normal traffic.

Question 18

What are some of the ways to resolve the issues of class balancing?

Answer 18

Cost function based approaches to assign costs to minority instances

Question 19

How are predictive models evaluated?

Answer 19

Leave one out
Hold out
Prospective sampling
Randomization

Question 20

How does Leave One Out work?

Answer 20

Uses K-fold partitioning which is a technique to build a model on K-1 folds of the data and evaluate against the final fold.

Question 21

How does Hold out evaluation work?

Answer 21

Divide the data into two, use for section for training and one for testing.

Question 22

How does prospective sampling work?

Answer 22

Uses a new sampled dataset seperate from the dataset

Question 23

How do Randomisation methods work?

Answer 23

Use sample instances without replacement

Question 24

What metrics are used to ass classification models?

Answer 24

True Positive (TP)
True Negative (TN)
False positive (FP)
False Negative (FN)

Question 25

What is sensitivity?

Answer 25

The True Positive Rate.

TP/(TP+FN)

Question 26

What is specificity?

Answer 26

The True Negative Rate.

TN/(TN+FP)

Question 27

What is precision

Answer 27

TP/(TP+FP)

How many positive were correct

Question 28

What is the F-Measure

Answer 28

Harmonic mean of precision and sensitivity.

2TP/(2TP + FN + FN)

Question 29

How are thresholds used in ML algorithms?

Answer 29

Can return predictions using label or probability scores.

The discriminating threshold will be used to label data based on where it lies on the cutoff (line).

Question 30

What is the ROC?

Answer 30

Receiver Operator Characteristic (ROC).

Curve plots the FPR against the TPR for every threshold value used to assign instances to their class.

Question 31

What are the research issues of IDS using ML?

Answer 31

Using fixed thresholds to flag anomalies may not be as accurate as adaptable thresholds.

Scalability issues from data mining but the higher the volume of data the more difficult it is to process in real time.