A Novel Approach to Combine Misuse Detection and Anomaly Detection Using POMDP in Mobile Ad-Hoc Networks
Keywords:
Component, mobile ad hoc networks, intrusion detection, misuse detection, anomaly detection.Abstract
Security becomes out of the main concerns in
mobile ad hoc networks. Intrusion detection systems are reactive systems that act as a second wall to protect the network. Misuse detection is a technique which is used commonly by intrusion detection systems to match the attack- signature pattern in mobile ad hoc networks. Anomaly detection is another technique that is able to detect novel attacks. Both of the misuse detection and the anomaly detection techniques monitor system activities. The weak point of misuse detection is the disability in detection of unknown attacks. Anomaly detection is able to detect unknown attacks but false positive rate in anomaly detection responses is so high.
Therefore in this paper we take advantages of combination schemes to overcome the shortco-ming of each technique. We propose a novel approach to combine the misuse detection with the anomaly detection optimally to save cost associated with resource constraints and security requirements. We
perform the whole system as a partially observed Markov decision process considering both system security and resource constraints. We then use dynamic programming Hidden Markov Model (HMM) to share information history and scheduling. Simulation shows the efficiency of proposed scheme.
Downloads
Downloads
Published
Issue
Section
License
You are free to:
- Share — copy and redistribute the material in any medium or format for any purpose, even commercially.
- Adapt — remix, transform, and build upon the material for any purpose, even commercially.
- The licensor cannot revoke these freedoms as long as you follow the license terms.
Under the following terms:
- Attribution — You must give appropriate credit , provide a link to the license, and indicate if changes were made . You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
- No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
Notices:
You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation .
No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material.
