A Comparative Evaluation of Anomaly Detectors under Portscan Attacks

摘要: Since the seminal 1998/1999 DARPA evaluations of intrusion detection systems, network attacks have evolved considerably. In particular, after CodeRed worm 2001, volume and sophistication self-propagating malicious code threats been increasing at an alarming rate. Many anomaly detectors proposed, especially in past few years, to combat these new emerging attacks. At this time, it is important evaluate existing determine learn from their strengths shortcomings. paper, we performance eight prominent network-based under portscan These ADSs are evaluated on four criteria: accuracy (ROC curves), scalability (with respect varying normal attack traffic rates, deployment points), complexity (CPU memory requirements during training classification,) delay. criteria using two independently collected datasets with complementary strengths. Our results show that a provide high one datasets, but unable scale across datasets. Based our experiments, identify promising guidelines improve future detectors.