Performance Evaluation of Anomaly-Based Detection Mechanisms

摘要: Common practice in anomaly-based intrusion detection is that one size fits all: a single anomaly detector should detect all anomalies. Compensation for any performance shortcomings sometimes effected by resorting to correlation techniques, which could be seen as making use of diversity. Such diversity intuitively based on the assumption coverage different – perhaps widely detectors, each covering some disparate portion space. Diversity, then, enhances combining coverages individual detectors across multiple sub-regions space, resulting an overall superior detector. No studies have been done, however, measured effects obtained. This paper explores using diverse anomalydetection algorithms (algorithmic diversity) detection. Experimental results indicate while performance/coverage improvements can fact algorithms, gains are surprisingly not result large, non-overlapping regions Rather, at edges and heavily dependent parameter values well characteristics As consequence this study, defenders provided with detailed knowledge how combine parameterize them, under what conditions, effect