Packet Sampling Applications in Campus High-Speed Network Intrusion Detection System

Abstract:

A technique of high-speed network intrusion detection system based on packet sampling theory is proposed. Starting with basic principles of packet sampling, this paper first analyses the significant mathematical conclusion of sampling strategies, then after discussing current strategies, mechanism and performance of different packet sampling methods, we specify an efficient strategy of packet sampling. Results show that this method can attain above 55% accurate rate with below 1% false rate in 94 specified attacking cases from DARPA 2000 IDS evaluation dataset.

• Periodical: Advanced Materials Research (Volumes 760-762)
• Pages: 2010-2013
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.760-762.2010
• Online since: September 2013
• Authors: Hui Qing Qiu, Cong Wang, Jie Lu
• Keywords: High-Speed Network, Intrusion Detection, Packet Sampling

References

[1] Using sflow and InMon Traffic Server for Intrusion Detection and other Security Applications. [Z] InMonCorp, (2001).

[2] J Reves, S Panchen, Traffic Monitoring with packet-based Sampling for defense against security Threats[A] . PAM 2002[C], (2002).