Proceedings of the International Conference on Inventive Computing and Informatics (ICICI 2017)

IEEE Xplore Compliant - Part Number: CFP17L34-ART, ISBN: 978-1-5386-4031-9

A Survey on Intrusion Detection System (IDS) and

Internal Intrusion Detection and Protection System
(IIDPS)
Amol Borkar Akshay Donode Anjali Kumari
Dept. of Computer Engg Dept. of Computer Engg Dept. of Computer Engg
Sinhgad Institute of Technology Sinhgad Institute of Technology Sinhgad Institute of Technology
Lonavala, India Lonavala, India Lonavala, India
[email protected] [email protected] [email protected]

Abstract— Around the world, billions of people access In this paper, section II presents the types of attacks. In
the internet today. Intrusion detection technology is a new section III, IIDS with their types is present. The literature
generation of security technology that monitor system to survey shown in section IV. In the section, V paper concludes.
avoid malicious activities. The paper consists of the
literature survey of Internal Intrusion Detection System II. TYPES OF ATTACKS
(IIDS) and Intrusion Detection System (IDS) that uses The attacks can be passive or active [1]. The active attack
various data mining and forensic techniques algorithms for is characterised by the attacker attempting to break into the
the system to work in real time. Data mining methods are system. During an active attack, the intruder will introduce data
proposed for cyber analytics in support of intrusion into the system as well as potentially change data within the
detection. system. The types of active attacks are distributed DOS, session
replay and masquerade. Viruses, Worms, Trojan are the
Keywords— Internal Intrusion Detection System example of active attacks. The passive attack attempts to learn
(IIDS), Intrusion Detection System (IDS), System Call or make use of information from the system but doesn’t affect
(SC), Denial of Service (DOS). system resources. Tapping, Encryption, Scanning are some
types of passive attacks. An attack can also be wreaked by an
I. INTRODUCTION outsider or an insider of the company. An insider attack is a
In Today’s world, several organisations store their data in malicious attack carried out on a network or computer system
several ways. These organisation's only requirement is to a person with authorised system access. UBS PaineWebber is
protect their private and official data from the intruders and one of the types of insider attacks. An outsider attack initiated
external, internal intruders. It may also be possible that some by an illegal use of the system. Spoofing, Spam, Spin are some
authorised user may leak the data of the organisation for any of the types outsider attacks.
purpose. In real-time, it is challenging to recognise the attacker
because duplicate IP and attack packets can create. Techniques Pharming:
used before like firewall, and IDS was not able to detect the Pharming involves a hacker infiltrating a computer system
real-time attackers which occurred in the absence of the admin and installing malicious code that causes website traffic from
without his knowledge. A computer network is the combination the network to redirected to bogus sites developed by the
of a set of hardware and software. Both components have their hacker. Many websites require the user's personal information.
risks, vulnerabilities and security issues. The attack in the Private and personal information entered into these fake sites is
software makes the data vulnerable. The ones who know then captured by the pirate. DNS cache poisoning host file
programming and systems can easily find out the various modification are the methods of pharming attacks.
activities performed on the systems using log files. They can
help in ensuring security. The problem arrives when people DOS (Denial of Service):
don't have any underlying knowledge of programming, and DOS is an attack where the perpetrator seeks to make a
their system gets attacked by the intruders, and they can’t find machine or network resource unavailable to its intended users
out the problem. There are various types of attacks. But the by temporarily or indefinitely disrupting service of a host
most challenging one is to find out the insider/internal attack. connected to the internet. Flooding in the network, disrupting
The network security is an area where every user wants his the connections, preventing the access of individuals are some
systems to protected from all the malicious attacks (internal or examples of DOS attacks. DOS attacks deprive legitimate users
external attacks). The external attacks by the intruders can be of the service they expected.
detected by IDS, and IIDS can identify the internal intruders. In
return, these techniques help us to protect our systems.

978-1-5386-4031-9/17/$31.00 ©2017 IEEE 949

 Proceedings of the International Conference on Inventive Computing and Informatics (ICICI 2017)
IEEE Xplore Compliant - Part Number: CFP17L34-ART, ISBN: 978-1-5386-4031-9

Eavesdropping Attack: A Brute force attack is a trial-and-error method used to

Eavesdropping is an electronic attack where digital obtain information such as passwords, or PIN (Personal
communication is interrupted by an individual whom they are Identification Number). A dictionary attack, searches attacks
not intended. Man in the middle attack is the best example of rule-based search attacks are types of brute force attacks. This
eavesdropping attack. Directly listening to digital or analog attack can avoid by having strong password content.
voice communication and shifting of data relating to any form
of communication are two main types of eavesdropping attack. III. IIDS

Network-based attacks are threats that are originated and

System Server managed by a device or devices other than those under attack.
DOS attacks and distributed- DOS attacks are examples of
network-based attacks. Firewalls and intrusion prevention
system are countermeasures to these types of attacks. A host-
based IDS system monitors and analyses the internals of a
computing system. A general IIDS uses a database of system
objects it should monitor.

System call monitor

Man-in-middle, phisher
Original connection
New connection
User
authentication Mining User
Fig. 1. Example of Eavesdropping Attack
Filter Behaviours
System
Phishing Attack: with OTP
Phishing is an attack to obtain sensitive information for
malicious reasons. These information’s includes usernames, Attacker
passwords, credit card details and more. Spear phishing, clone Detection Server List
phishing, whaling are the types of phishing attacks.

Spear phishing:
Fig. 2. Proposed System Architecture
Spear phishing is a type of e-mail spoofing which targets an
individual or an organisation to access its sensitive information. IIDS were developed to detect the internal intruders. These
systems were not as accurate as the proposed system. This
Clone phishing: method performs at real time and hence increase the accuracy
Clone phishing is a type of phishing where the recipient's by a noticeable percentage.To improve the security; a technique
address is duplicate for creating an identical e-mail having has proposed where the administrator will get an OTP on
different content. registered email id or the mobile number. Real-time images and
activities are captures through webcam or screenshots which
Whaling phishing: provides the intruder activity list.
Whaling phishing is a type of phishing which targets the
high-profile group that includes senior executives, celebrities, IV. LITERATURE SURVEY
businessmen’s, politicians etc. Technical support scams, According to [2], a system to accurately detect potential
infected attachments, social media exploits, fraud scams are the attack has developed by using various techniques like decision
examples of phishing. free, Random forest and KNN.To overcome the limitation of
the previous system that was not able to detect the IPV6 attacks,
DDOS (Distributed Denial of Service) Attack: a new method are proposed. The developed system produce the
In DDOS, the incoming traffic flooding the victim impressive and efficient result in identifying IPV4-based attack
originates from many different sources. In DDOS attack, the keeping in mind the future scope. The effectiveness of various
perpetrator uses more than one IP addresses. The primary algorithm evaluated. Detection accuracy, precision, recall
difference between DOS and DDOS includes the usage of percentage were measured.
systems in both the attacks. DOS uses the single internet
connections in a network whereas DDOS uses multiple links [3] Has stated that clustering and KDD can be efficiently
connected to various devices. used to detect novel anomaly called NEC. An unsupervised
anomaly is used to produce high detection rate and less false
Brute Force Attack: passive rate. It is an appropriate way to solve the problem and

978-1-5386-4031-9/17/$31.00 ©2017 IEEE 950

 Proceedings of the International Conference on Inventive Computing and Informatics (ICICI 2017)
IEEE Xplore Compliant - Part Number: CFP17L34-ART, ISBN: 978-1-5386-4031-9

find the anomaly which does not need a labelled data set. The detection accuracy which is up to 73%. But this method is not
system is verified over NSL-KDD 2009 dataset. The at all suitable for big data problem capturing such as data logs
preprocessing model transforms all features into the real is also tricky. The system leverages features of signature-based
number and normalised dataset at the end the evaluation and specification based IDS. The data mining technique that
component will compare predicate result an accurate result. aggregates audit logs from multiple system devices to learn the
standard path. The automated approach eliminates the need to
Concerning A Survey of Data Mining and Machine manually analysis and manually code pattern.
Learning for CSID [4], a survey of data mining and machine
learning for cybersecurity instruction detection is performed to According to Flow anomaly based. [9], this paper based on
ensure cybersecurity. Packet-header and net flow packet header the flow anomaly Intrusion Detection System for Android
are used for the instruction detection system to be able to reach mobile devices this approach uses ANN (Artificial Neural
networks and kernel level data. The future scope that is kept in Network) on Android Operating System to detect anomaly
mind is that data mining and machine learning cannot ware behaviours in android mobiles. Accuracy and detection rate of
without representative data and also it’s very time-consuming. this methodology reaches 85% and 81% respectively. Imitation
The complexity of different machine learning and data mining is considered regarding CPU, memory and battery power this
algorithm is discussed, The paper also provides a set of work endeavours to identify a lightweight, scalable an efficient
comparison criteria for machine learning/data mining methods IDS for an android environment various services are provided
Intrusion Detection System help discovered, determine and for addressing public attacks. The data streams are analysed by
identify unauthorized used, duplication, alteration and using efficient machine learning algorithms. The future scope
destruction of the information system. includes the improvement in accuracy and detection rate.

An [5], confirmed that on the advanced method for As proposed [10], A Hidden Markow model based IDS is
detection to improve the security by identifying and tracking developed for software-defined networking (SDN). SDN
the attacker using machine learning, ranking and Voronoi network can help monitor the overall security of a system by
clustering is proposed the paper ensure reducing the size of data analysing the web as a hole and making choices to defend the
set and high detection accuracy. A data set called ISOT has network based on the data from the entire network it includes
been used keeping in mind the processing delay in the large- uses of ANN IDS. This methodology allows greater dynamic
scale network UDP and TCP are examined to recognize achieve control of a networking environment. The paper consists of the
instruction growth in network traffic is taken care of machine advantages like increased in the range of activities and also is
learning modules act like deep neural network various botnet the increase of security application. It has shown that machine
techniques are provided DNA based method is developed by learning application holds the potential to be used to access the
the system help. The paper also uses characteristics of the risk in networking environment for the future scope expanding
network flow to detect the botnet intrusion despite packet the feature vector used by HMM in determining the
payload content, which helps in encryption of packet. maliciousness of a set data are to be added.

According to An ADS-B IDS [6], an automatic dependent [14] Referred that cybersecurity is severe issues in the
surveillance-broadcast IDS technique are proposed by using cyberspace. The paper includes the demonstration of a
ADS-B techniques. HMAC data set has been used to increase neuromorphic cognitive computing approach for network IDS
the performance of air traffic control. The methods operate with for cybersecurity using deep learning. This method uses
minimal overhead. The future scope says for ADS-B position Discrete Vector Factorization. The NSL-KDD dataset is used
to be valid, its distance from the corresponding one at a time t to increase accuracy and classification up to 90.12% and 81.31%
as to be within the safe zone. ADS-B as emerged as an respectively. Deep learning achieves human-level performance
alternative to current radio, radar standards in aircraft signalling in particular for recognition tasks, in-depth learning approach
superior location accuracy are the provided by GPS using the combining the features of extraction classification. The future
cyber-physical environment the attack detection is confirmed. scope includes the challenge of determining the representation
A mechanism is proposed to exchange the keys used for the of data in spiking format for the use in the True- North-System.
HMAC algorithm securely. ATC Centre initiates firm
handshakes with ATC's that control another zone in the flight- According to [13], this paper based on the Intrusion
path to transfer the private key over public key infrastructure detection system for PS-Poll DOS attack in 802.11 networks
(PK1) schemes. using real-time discrete event system. This approach uses
RTDES on real-time discrete event system for detecting DOS
[7] This paper stated that using common path mining a attack. One of the important advantages is high accuracy and
hybrid IDS using data mining is developed for a power system detection rate, but one of the major drawbacks is a loss of
that uses data logs the approach is an automated approach to frames. Detect the PS-DOS attack require encryption change
build the hybrid IDS. One of the important advantages is in protocol or installation of proprietary hardware.

978-1-5386-4031-9/17/$31.00 ©2017 IEEE 951

 Proceedings of the International Conference on Inventive Computing and Informatics (ICICI 2017)
IEEE Xplore Compliant - Part Number: CFP17L34-ART, ISBN: 978-1-5386-4031-9

TABLE I
DIFFERENT TECHNIQUES OF IDS

Algorithm/Technique Reference Test Data Used Purpose of IDS Advantages Limitations/Future

Used Paper Scope
Decision tree, random [2] To accurately detect Produce impressive and IPV6 attacks cannot
forest, K-NN. NA potential attacks. efficient results in be detected yet.
detecting IPV4-based
attacks.
Clustering and KDD. [3] NSL-KDD 2009 To detect novel Quality labelled High false positive
dataset. anomalies called datasets are not Rate and high
NEC. required. detection rate.
Data Mining and [4] Packet headers To ensure IDS can reach networks Data Mining and
Machine Learning. and net flow cybersecurity. and kernel level data. Machine Learning
packet headers. can’t work without
representative data
and is very time-
consuming.
Machine Learning, [5] ISOT Improve the security Reduce the size of the Processing delays in
Ranking, Voronos by identifying and dataset, high detection the massive scale of
clustering. tracking the attackers. accuracy. the network.
Automatic Dependent [6] HMAC. To increase the Operates with minimal An ADS-B position
Surveillance-Broadcast performance of air overhead. to be valid, its
(ADS-B). traffic control. distance from the
corresponding one at
a time t has to be
within the safe zone.
Common Path Mining. [7] Data logs. An Automated Detection accuracy is Not suitable for big
approach to building 73%. data. Problem
a hybrid IDS. capturing such as
data logs is difficult.
Epigenetic algorithm. [8] KDD-NSL. Additional an It helps to prevent more Reduction of total
information of future preciously the curable iterations to obtain
offspring. and not curable diseases the optimal solution
based on environmental is a shorter time.
factors that do not fit in
the sequenced gene.
Artificial Neural [9] Android OS Detect the anamoly Accuracy and detection Further, improving
Network (ANN), IDS. behaviours in android rate reaches 85% and the accuracy and
mobiles. 81% respectively. detection rate.
SDN, NIDS. [10] NA Allows greater Increase the range of Expanding the
dynamic control of a activities, increase the features vectors used
networking efficiency of security by the HMM in
environment. applications. determining the
maliciousness of a
set of data.
Genetic Programming [11] NSL-KDD To solve the problem Classification accuracy New GFS hybridised
Fuzzy Inference of classification in is higher. with a neural
System for IDS. network.
Classification (GPFIS-
Class)
Hybrid Cryptography [12] NA To reduce the More powerful and Reduce PDR
network and routing secure than MANET PDR=total packet
overhead. received / Total
packet sent.

978-1-5386-4031-9/17/$31.00 ©2017 IEEE 952

 Proceedings of the International Conference on Inventive Computing and Informatics (ICICI 2017)
IEEE Xplore Compliant - Part Number: CFP17L34-ART, ISBN: 978-1-5386-4031-9

Real-Time Discrete [13] NA A timed IDS based or Preserves much energy, Loss of frames.
Event System. real-time discrete high accuracy,
(RTDES) event system for detection rate.
detecting DOS attack.
Discrete Vector [14] NSL-KDD To demonstrate a 90.12% and 81.31 are It is challenging to
Factorization (DVF) in- neuromorphic the accuracy and determine the
depth learning cognitive computing classification representation of
approach. approach for network respectively. data in spiking
IDS. format for the use in
the True-North
system.

[5] Manoj s. Koli, Manik K. Chavan, “An Advanced method for

detection of botnet traffic using Internal Intrusion Detection”,
V. CONCLUSION AND FUTURE SCOPE 2017 International Conference on (ICICCT), March 10-11, 2017,
As per the studied of techniques suggested by various Sangli, India.
authors, the ways it can detect the intruder are presented here. [6] Thabet Kacem, Duminda Wijesekera, Paulo Costa, Alexander
The conclusion that can be drawn from the survey stated above Barreto, “An ADS-B Intrusion Detection System”, 2016 IEEE on
is the paper [7] [8] [14], has accuracy and detection rate ISPA, 2016, Fairfax, Virginia.
maximised to 90.12% whereas the techniques proposed by us [7] Shengyi Pan, Thomas Morris, Uttam Adhikari, “Developing a
increase the accuracy and detection rate up to 95%. A Survey Hybrid Intrusion Detection System using Data Mining for power
system”, IEEE Transactions on, vol. 6, issues. 6, Nov. 2015.
from [3] includes high false positive rate, but our system [8] Mehdi Ezzarii, Hamid Elghazi, Hassan El Ghazi, Tayeb Sadiki,
reduces the false positive rate comparatively. One of the "Epigenetic Algorithm for performing Intrusion Detection
surveys from [5] suggests that there are processing delays in System",2016 International Conference on ACOSIS, Oct17-
large scale of network there in our system, the intruders are 19,2016, Rabat, Morocco.
detected in real time and also provides a list of intruders and [9] Panagiotis I. Radogloa-Grammatikis; Panagiotis G. Sarigannidis,
their activities and comparatively to the survey [4], it is less "Flow anamoly based Intrusion Detection System for Android
time consuming, So, when designing a new IDS, these Mobile Devices", 2017 6th International Conference on
characteristics can be used in real time system to detect the MOCAST, May 4-6, 2017, Kazani, Greece.
internal intruders and their malicious behaviours. This will be [10] Trae Hurley, Jorge E. Perdomo, Alexander Perez-pons, "HMM-
Based Intrusion Detection System for software-defined
a valid IDS which will identify the internal intruder's accurately networking", 2016 15th IEEE Conference on Machine Learning
in real time and can be used by several firms, MNC's for and Application, Dec 18-20, 2016, Miami, Florida.
protecting their valuable data. [11] Mariem Belhor, Farah Jemili, "Intrusion Detection based on
genetic fuzzy classification system", 2016 IEEE 13th
ACKNOWLEDGEMENT International Conference on Computer Systems and Application
(AICCSA), Nov 29 2016-Dec 2, 2016, Sousse, Tunisia.
We are mainly thanks to our guide Prof. R.S.Shishupal who [12] Sharad Awatade, Shweta Joshi. "Improved EAACK: Develop
has provided guidance, expertise, encouragement. Thanks to all Secure Intrusion Detection System for MANETS using hybrid
those who helped me in the completion of this work knowingly cryptography", 2016 International Conference on computing
or unknowingly. communication control and automation (ICCUBEA), Aug 12-13,
2016, Maharashtra, India.
[13] Mayank Agarwal, Sanketh Purwar, Santosh Biswas, Sukumar
REFERENCE Nandi, "Internal Detection System for PS-Poll DOS attack in
[1] Lazarevic, Aleksander, Yipin Kumar and Jaideep 802.11 networks using real-time discrete event
Srivastava, "Intrusion Detection: A Survey", managing cyber system",IEEE,vol.4,issue4,2017.
Threats, Springer US, 2005, pp 19-78, 2005. [14] Md Zahangir Alom, Tarek m. Taha, "Network Intrusion
[2] Mohammed Anbar, Rosni Abdulah, Izan H. Hasbullah, Yung- Detection for cybersecurity on neuromorphic computing
Wey Chong; Omar E. Elejla, “Comparative Performance system”, 2017 International Joint Conference on Neural
Analysis of classification algorithm for Internal Intrusion Networks (IJCNN), May 14-15,2017, USA.
Detection “, 2016 14th Annual Conference on Privacy Security
and Trust (PCT), Dec 12-14,2016, Penang, Malaysia.
[3] Weiwei Chen, Fangang Kong, Feng Mei, GuiginYuan, Bo Li, “a
novel unsupervised Anamoly detection Approach for Intrusion
Detection System”, 2017 IEEE 3rd International Conference on
big data security on cloud, May 16-18,2017, Zhejiang, China.
[4] Anna L. Buczak, Erha n Guven, "A Survey of Data Mining and
Machine Learning methods for cybersecurity intrusion
detection", IEEE communication surveys and tutorials, vol. 18,
Issue 2,2016.

978-1-5386-4031-9/17/$31.00 ©2017 IEEE 953