Two Layer Network Intrusion Detection System

Abstract

Due to the rapid growth of networked computer resources and the increasing importance of related applications, intrusions which threaten the infrastructure of these applications become critical problems today. In recent years, intrusion detection systems (IDS) are proposed to find and prevent the intrusion behaviors on network. However, as the intrusions become more and more complicated, general intrusion detection system based on monitoring network connections seems not useful for all kinds of intrusions, and Distributed IDSs are proposed to detect intrusions by cooperating different kinds of intrusion detection mechanism. In this work, a Two Layer Network Intrusion Detection System, which combines a general intrusion detection system and an inference engine to detect network intrusions, is designed. With these two mechanisms, both general network packet based intrusions and complicated intrusions can be detected. A prototype of this system together with the detection models about several complicated intrusions are designed and implemented to show the detection capability of the prototype.