Comparative Study between
Signature-Based & Anomaly-Based Network Intrusion Detection System (SBNIDS & ABNIDS)
Researchers:
Chiadighikaobi Ikenna, Johari Abdullah.
Faculty of Computer Science & Information Technology, Universiti Malaysia Sarawak, 94300 Sarawak, Malaysia
1.0 INTRODUCTION
• Identify detection rate and false alarm using SBNIDS and ABNIDS
• Perform comparative study between SBNIDS (Snort) and ABNIDS
(PHAD) using 1999
offline DARPA dataset
2.0 OBJECTIVE
1.To select suitable
comparison parameters between different
approach in intrusion detection.
2.To evaluate suitable software/system for
deploying SBNIDS and ABNDS.
3.To conduct experimental study to evaluate the
differences in selected parameters in (1).
SBNIDS Results
ABNIDS Results
4.0 METHODOLOGY
• SBNIDS and ABNIDS was evaluated using 1999 offline DARPA dataset.
• The evaluation was done on Snort and PHAD intrusion detection
software/tools.
• The dataset used for the evaluation
consists of week 1 and 3 (attack free data) and week 4 and 5 (attack
data).
• The experiment was tested on three parameters:- Performance, Time and CPU and Memory uage.
5.0 CONCLUSION
o ABNIDS is better than SBNIDS in the area of actual detection rate,
detection time and CPU and Memory usage
6.0 FUTURE WORKS
Improve signture-based to detect recent attack.
Improve Anomaly-based by reducing false positive.
Generally improve IDS detection rate, by creating a detection engine to
support Signature-based and Anomaly-based.
3.0 SYSTEM DIAGRAM
Acknowledgement:
This work is a Final Year Project under the Faculty of Computer Science & Information Technology, UNIMAS.
