Quantification for Intrusion Detection System Using Discrete Fourier Transform
Yusuke Tsuge, Hidema Tanaka · 2016
An Intrusion Detection System (IDS) is a countermeasure against network attack. There are mainly two types of detections; signature-based and anomaly-based. Since attackers change their technique rapidly, anomaly-based detection draws research interest nowadays. Since some anomaly-based IDS depends on operator's visual identification, it is difficult to define normal behavior effectively. To solve the problem, we propose quantification method using Shannon-Hartley theorem which improves Enkhbold et al. method. This method uses Discrete Fourier Transform to analyze spectrum of each session. They assume fluctuation of spectrum in normal sessions as random and abnormal sessions as biased. To quantify difference between each spectrum and the standard one, we can obtain entropy using Shannon-Hartley theorem. By spectrum analysis based on such assumption, it is possible to create the Detection-table which can be determined either normal or abnormal sessions. And we also find out that our quantification method will discover the feature of unknown attack session.