Flow Based Network Intrusion Detection System usingHardware-Accelerated NetFlow Probes

摘要: Current network intrusion detection methods based on anomaly detection approaches suffer from comparatively higher error rate and low performance. Proposed flow intrusion detection system addresses these issues by (i) using hardware-accelerated probes to collect unsampled NetFlow data from gigabit-speed links (ii) combining several anomaly algorithms means of collective trust modeling, a multi-agent data fusion method. The acquired on the is preprocessed passed anomaly detection models gather independent opinions for each flow. The several trust models aggregate the anomalies with past experience, flows are re-evaluated obtain their trustfulness, which further aggregated detect malicious traffic. Experiments performed on-line real campus illustrate suitability for real-time surveillance.