Evaluation of Contemporary Anomaly Detection Systems (ADSs)

View Sample PDF

Author(s): Ayesha Binte Ashfaq (National University of Sciences & Technology (NUST), Pakistan)and Syed Ali Khayam (National University of Sciences & Technology (NUST), Pakistan)
Copyright: 2012
Pages: 23
Source title: Cyber Security Standards, Practices and Industrial Applications: Systems and Methodologies
Source Author(s)/Editor(s): Junaid Ahmed Zubairi (SUNY at Fredonia, USA)and Athar Mahboob (National University of Sciences & Technology, Pakistan)
DOI: 10.4018/978-1-60960-851-4.ch006

Keywords: Information Science Reference / Information Security & Privacy / IT Security and Ethics / Security & Forensics

Purchase

View Evaluation of Contemporary Anomaly Detection Systems (ADSs) on the publisher's website for pricing and purchasing information.

Abstract

Due to the rapidly evolving nature of network attacks, a considerable paradigm shift has taken place with focus now on Network-based Anomaly Detection Systems (NADSs) that can detect zero-day attacks. At this time, it is important to evaluate existing anomaly detectors to determine and learn from their strengths and weaknesses. Thus we aim to evaluate the performance of eight prominent network-based anomaly detectors under malicious portscan attacks. These NADSs are evaluated on three criteria: accuracy (ROC curves), scalability (with respect to varying normal and attack traffic rates, and deployment points) and detection delay. Based on our experiments, we identify promising guidelines to improve the accuracy and scalability of existing and future anomaly detectors. We show that the proposed guidelines provide considerable and consistent accuracy improvements for all evaluated NADSs.

The IRMA Community

Research IRM

Evaluation of Contemporary Anomaly Detection Systems (ADSs)

Purchase

Abstract

Related Content

IRMA Sponsors