Intrusion detection in computer networks

Computer security is now becoming a major concern of modern society as a large fraction of information flows through computer networks. Standard protection mechanisms such as user authentication, service control, and traffic filtering cannot guarantee from the risk of computer attacks. The main reason of the weakness of computer networks lies in the great variability of network traffic, and in the so-called “bugs” always contained in system and application software. As a consequence, it is extremely difficult to design rules apt to selectively block intruders’ traffic while allowing legitimate traffic.

To design more flexible systems, a number of research papers recently proposed approaches to intrusion detection based on pattern recognition techniques. The pattern recognition approach is expected to help in extracting complex decision rules, that can hardly be implemented by human experts through rule-based systems. Results presented in the literature clearly show the potential of the pattern recognition approach as well as its drawbacks. In fact, while pattern recognition approaches can detect intrusions for which no specific training data were available, they often produce a large number of false alarms, as legitimate traffic can be classified as being intrusive.

The challenges posed by this novel pattern recognition application involve all the design phases of a pattern recognition system, i.e., data collection, feature extraction and selection, classifier design, and performance evaluation.

To date, our principal research interest involves:

• anomaly detection techniques
• multiple classifier systems
• learning in an adversarial environment
• detection reliability enhancement and alert verification applied to detect intrusions in computer systems. 

People working on this topic:

• Davide Ariu
• Igino Corona
• Giorgio Giacinto

Publications on Intrusion detection in computer networks