A Distributable Hybrid Intrusion Detection System for Securing Wireless Networks

We developed a hybrid design to a NIDS that enables the seamless insertion of a machine learning component into a signature NIDS system that significantly improves throughput as well as captures additional networking traffic that is similar to known attack traffic. The throughput improvement by incorporating a normalcy classifier is significant, estimated to be the inverse of the false alarm rate which can easily net a factor of 1000. However, this can be diminished by updates that can trigger a retraining of the normalcy classifier. The addition of a normalcy classifier front-end also makes the system more highly scalable and distributable than the signature-based NIDS. The new hybrid design also allows distributed updates and retraining of the normalcy classifier to stay up-to-date with current threats, and makes a number of important performance and quality guarantees. The distributable hybrid implementation is very useful for securing wireless networks with multiple access points. This system design also has the capability to recognize new attacks that are similar to known attack signatures. The hybrid design also can provide significant information on new attack traffic. By finding the signature of suspicious traffic that is similar to the signature of a known attack, it can be isolated and analyzed as a potential variant of a known attack.