Survey on Updating IDSs’ Signatures Databases
Article content
Abstract
With the rapid development and growth of the internet and networking, greater numbers of attacks are arising that
threaten networks and information security alike. Thus, different types of intrusion detection systems (IDSs) have
been introduced: either signature-based IDSs, anomaly-based IDSs, or a hybrid of both. Many IDSs that have adopted
the signature-based method suffer from many challenges, one of these challenges is how to detect a new attack in the
incoming traffic that its signature doesn’t stored in the known signatures database, while at the same time keeping the rate
of false-positive alarms low. Many IDSs update their signatures databases from time to time through the internet or by
relying on the network administrator to manually update the database with new attack signatures. Manual updating is a
labour-intensive process, can be prone to errors, and is not always practical. This is a survey paper on the various studies
regarding the updating process for known IDSs’ signatures databases over time.
Keywords
Intrusion Detection System, signature-based, anomaly-based, traffic, false positive, update
Downloads
References
P. Bunel, “An introduction to Intrusion Detection Systems,” in SANS Conf., London, UK, June 2004.
U. Bashir and M. Chachoo, "Intrusion detection and prevention system: Challenges & opportunities," in 2014 Int. Conf. on Comput.Sustain. Glob. Develop. (INDIACom), New Delhi, pp. 806-809. doi: 10.1109/IndiaCom.2014.6828073.
K. R. Rao, A. Pal, and M. Patra, “A service oriented architectural design for building intrusion detection systems,” Int. J. Recent Trends Eng., vol. 1, no. 2, May 2009.
A. Sharma, A. K. Pujari, and K. K. Paliwal, "Intrusion detection using text processing techniques with a kernel-based similarity measure," Comput. Secur., vol. 26, no. 7-8, pp. 488–495, Dec.2007, doi: 10.1016/j.cose.2007.10.003.
C. Xenakis, C. Panos, and I. Stavrakakis, “A comparative evaluation of intrusion detection architectures for mobile ad hoc networks,”Comput. Secur., vol. 30, no. 1, pp. 63-80, Jan. 2011, doi:10.1016/j.cose.2010.10.008.
M. Salour and X. Su, "Dynamic Two-Layer Signature-Based IDS with Unequal Databases," in Fourth Int. Conf. Inf. Technol.(ITNG'07), Las Vegas, NV, 2007, pp. 77-82, doi: 10.1109/ITNG.2007.80.
M. Uddin, A. A. Rahman, N. Uddin, J. Memon, R. A. Alsaqour,and S. Kazi, “Signature-based multilayer distributed intrusion detection system using mobile agents,” Int. J. Netw. Secur., vol.15, no. 2, pp. 97–105, Mar. 2013.
H. G. A. Umar, C. Li, and Z. Ahmad, “Parallel Component Agent Architecture to Improve the Efficiency of Signature Based NIDS,” J. Adv. Comput. Netw., vol. 2, no. 4, pp. 269-273, Dec.2014, doi: 10.7763/JACN.2014.V2.124.
O. Folorunso, F. E. Ayo, and Y. Babalola, “Ca-NIDS: A network intrusion detection system using combinatorial algorithm approach,” J. Inf. Priv. Secur., vol. 12, no. 4, pp. 181–196, Dec. 2016.
A. H. Almutairi and N. T. Abdelmajeed, "Innovative signature based intrusion detection system: Parallel processing and minimized database," in 2017 Int. Conf. Frontiers Adv.in Data Sci. (FADS), Xi'an, 2017, pp. 114-119, doi: 10.1109/FADS.2017.8253208.
Article details
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
You must read and accept the copyright terms and conditions(click here for copyright terms).