An Evaluation of Size-based Traffic Feature for Intrusion Detection

Network attacks have become a significant threat to organizations and effective intrusion detection systems have to be developed detect these attacks before they inflict harm to the internal network infrastructure. Denial of service (DoS) and probing attacks are the most common attacks. While time-based traffic features provide information to identify attacks, size-based traffic features enhance the identification accuracy. In this study, we add a size-based feature to an existing timebased feature intrusion detection system. The system is tested on a data set that includes both normal traffic and attack traffic from different types of attacks. The results indicate that size-based feature increases the accuracy of prediction. We also used meta-classification schemes such as bagging and boosting to examine if they improve the perforJISS ec 3 (1 ) 2007 www.jissec.o rg Journal of Information System Security