“Low Cost” Network Intrusion Detection

A new approach to intrusion detection is needed to solve the problems of larger and faster networks and the constraints on system administrator’s time to manage security systems. Current network intrusion detection systems lack solutions to these two problems being complex in design and generally incurring larger costs in terms of operation and maintenance. We propose a new technique to solve these problems that we call “Low Cost” intrusion detection. Our approach features minimal network traffic measurement, an anomaly-based detection method and a limited attack scope. The method is similar to other lightweight approaches in its simplified design, but our approach, being anomaly based, should be more efficient in both operation and maintenance than other lightweight approaches. We present the method and perform an empirical test using MIT Lincoln Lab’s data.