Nowadays maintaining security in the networking domain is very important and essential since the network is hacked by the unauthorized people. There are various strategies and mechanism have been applied which provide the security to some extent. Most of these security mechanisms principles are similar to encryption and firewall. Even though this mechanism provides security, but these strategies are failed to detect the intrusions in which there is a need for development of new technology and it is known as Intrusion detection system. The Intrusion detection systems are used to identify the problems like unauthorized use, misuse and abuse of computer networking systems. Outside attackers are not only the problem, the threat of authorized users misusing and abusing their privileges is an equally pressing concern. Intrusion detection systems are used to analyze the event occurrence in a system with the goal to indicate security issues. An intrusion detection system display networked units and appears for anomalous or malicious conduct within the patterns of exercise within the audit stream.This paper studied the basic concepts of intrusion detection, its need, components and challenges.

1. Integrated Intelligent Research(IIR) International Journal of Business Intelligent
Volume: 04 Issue: 02 December 2015,Pages No.57- 61
ISSN: 2278-2400
57
Intrusion Detection System – A Survey
S. Vijayarani1
R. Kalaivani2
1
Assistant Professor, Dept. of CS, Bharathiar University, Coimbatore, India
2
Ph.D.Scholar, Dept. of CS, Bharathiar University, Coimbatore, India
Abstract—Nowadays maintaining security in the networking
domain is very important and essential since the network is
hacked by the unauthorized people. There are various
strategies and mechanism have been applied which provide the
security to some extent. Most of these security mechanisms
principles are similar to encryption and firewall. Even though
this mechanism provides security, but these strategies are
failed to detect the intrusions in which there is a need for
development of new technology and it is known as Intrusion
detection system. The Intrusion detection systems are used to
identify the problems like unauthorized use, misuse and abuse
of computer networking systems. Outside attackers are not
only the problem, the threat of authorized users misusing and
abusing their privileges is an equally pressing concern.
Intrusion detection systems are used to analyze the event
occurrence in a system with the goal to indicate security
issues. An intrusion detection system display networked units
and appears for anomalous or malicious conduct within the
patterns of exercise within the audit stream.This paper studied
the basic concepts of intrusion detection, its need, components
and challenges.
Keywords—Network security, Intrusion detection system,
Anomalous detection, Data mining.
I. INTRODUCTION
Intrusion detection is that the downside of characteristic
people are employing a system while not authorization and
people have legitimate access to the system however are
abusing their privileges. These are usually observed because
the hacker and corporate executive threats severally. Intrusion
detection systems are a nature of security system for
computers and networks. Intrusion detection system gathers
and analyzes knowledge from varied areas among a PC and
network to determine come-at-able security breaches that
embody every intrusion (attacks from exterior the group) and
misuse (attacks from within the group). Intrusion detection
systems create use of vulnerability analysis (generally called
scanning), that is associate experience developed to judge the
safety of a system or network. [6]. Intrusion Detection
Systems (IDS) are primarily centered on characteristic
probable incidents, observation data regarding them, tries to
prevent them, and news them to security directors [6] in period
of time setting, and people that exercise audit knowledge with
some delay (non-real-time). The latter approach would
successively delay the instance of detection. Additionally,
organizations apply IDSs for alternative reasons, like
classifying issues with security policies, documenting existing
attacks, and preventing people from violating security policies.
IDSs became a basic addition to the safety infrastructure of
virtually each organization. A usual Intrusion Detection This
paper is organized as follows. Section 2 gives the need of the
intrusion detection system. Section 3 discusses the
components of intrusion detection system. The types of
intrusion detection system are discussed in section 4. Section 5
discusses the detection techniques in intrusion detection
system. Section 6 explains the details of prior works. Section 7
gives the overview of challenges in intrusion detection
system.Finally conclusion of this paper is discussed in section
8. System is demonstrated in Figure 1.
Fig.1. Simple Intrusion Detection System
II. INTRUSION DETECTION SYSTEM AND ITS
NEED
Intrusion detection system in a very similar method enhances
the firewall security. The firewall protects association from
malicious assaults from the online and therefore the Intrusion
detection system detects if someone tries to interrupt in by
method of the firewall or manages to interrupt inside the
firewall security and tries to own entry on any system inside
the trustworthy side and alerts the computer user just in case
there is a breach in safety. [2]Furthermore, Firewalls do a
wonderful job of filtering incoming website guests from the
Web; notwithstanding, their strategies to avoid the firewall. As
an example, exterior customers will connect with the computer
network by dialing in by method of electronic equipment put
in inside the non-public network of the cluster. This sort of
entry would not be seen by the firewall.Subsequently,
Intrusion detection system (Intrusion detection system) may be
a security system that checks pc strategies and network guests
and analyzes that visitant for attainable hostile assaults
originating from outside the cluster and likewise for system
misuse or assaults originating from contained within the
cluster. [2]
III. COMPONENTS OF INTRUSION DETECTION
SYSTEM
Intrusion Detection system contains of Management console
and sensors. Management console is that the management and
reporting console. Sensors agents that monitor hosts or
networks on a true time basis. An Intrusion Detection
Systemencompasses information of attack signatures. The
attack signatures are patterns of various styles of detected
attacks. [1]If the sensors discover any malicious activity, it
matches the malicious packet towards the assault signature

2. Integrated Intelligent Research(IIR) International Journal of Business Intelligent
Volume: 04 Issue: 02 December 2015,Pages No.57- 61
ISSN: 2278-2400
58
information. Just in case it finds a match, the device reviews
the malicious activity to the administration console. The
device will take wholly completely different actions primarily
based on however they are designed. For example, the device
will reset the communications protocol association by causing
a communications protocol FIN, modify the entry
management listing on the entrance router or the firewall or
send an email correspondence notification to the administrator
for applicable action. [1]. Fig 2 describes the components of
intrusion detection systems.
Fig.2.Components of Intrusion Detection System
IV. TYPES OF INTRUSION DETECTION SYSTEM
There are many styles of Intrusion detection system they're
characterized on the idea of various observation and analysis
approach. Otherwise of classifying Intrusion detection system
is to cluster them by information supply. Some Intrusion
detection systems analyze data sources generated by the
appliance computer code program or operating system for
indicators of intrusion. Alternative analyzes the network
packet captured from network link to seek out attackers [3].
Protected systems of Intrusion detection system are Network
based system and Host based system. Host based mostly
system monitors a personal host machine. Network based
system monitors the traversing of packet on network link [3].
Individuals got to use the Intrusion detection system so as to
spot attacks in host based system and network based system.
Fig 3 describes to use network based Intrusion detection
system within and outside the firewall.
Fig.3. Deployment of Intrusion Detection System Sensors
and Management Console in a Network
A. Network Based System
Network based Intrusion detection system check the packet
that traverses by manner of computer network section and
analyzes the network action to determine assaults. Listening
on a computer network section, network based Intrusion
detection system will monitor the network website guests
poignant variety of host that area unit associated with the
network section, so as that it should defend these hosts.
Network-based largely Intrusion detection systems typically
embody hosts or a group of single-function sensors positioned
at varied factors in an exceedingly computer network. Most of
those Sensors area unit style to run in secrecy mode, for the
aim of constructing it tougher for associate degree
attacker/intruder to work out their presence and placement [3].
Its most typically deployed at a boundary between networks,
like in virtual non-public network servers, wireless networks
and remote access servers [3].
Advantages of using network based Intrusion detection
system
 Network based Intrusion detection systems can be created
invisible to several attackers to provide security towards
assault.
 A couple of network based Intrusion detection systems
will monitor an outsized network.
 Network-based Intrusion detection systems area unit
usually passive units that hear on a network wire while
not meddling with the standard operation of a network.
Thus, it's usually easy to fit in associate existing network
to include network-based largely Intrusion detection
systems with borderline effort. [3]
Disadvantages of using network based Intrusion detection
systems
 Network-primarily based Intrusion detection system is
unable to analysis encrypted data as a result of many of
the cluster makes use of digital personal networks.
 Most of the advantages of network based Intrusion
detection system don‘t apply to small part of network i.e.
switch based mostly network. Observance vary of
switches are not universal, this limits the network based
mostly Intrusion detection system observance vary to
single host.
 Some network based Intrusion detection systems have
troublesome in managing network based attacks that
involve the packet fragmentation. This anomalously
designed packet triggers the Intrusion detection system to
change into unstable and crash. [3].
B. Host Based System
A host-based Intrusion detection system monitors activities
related to a selected host [3] and geared toward collection
information concerning activity on a bunch system or inside a
personal automatic data processing system. In host primarily
based Intrusion detection system separate sensors would be
required for a personal automatic data processing system.
Device monitors the event takes place on the system. Sensors
collect the information from system logs, logs generated by
OS processes, application activity, file access and
modification. These log file will be straightforward computer
file or operation on a system. [3]

3. Integrated Intelligent Research(IIR) International Journal of Business Intelligent
Volume: 04 Issue: 02 December 2015,Pages No.57- 61
ISSN: 2278-2400
59
Advantages of using Host based Intrusion detection system
 Host based Intrusion detection system will detect attacks
that can't be seen by network based Intrusion detection
system as a result of the monitor native events of a bunch.
 Host based totally Intrusion detection system operate on
OS audit trails that will assist to detect assaults contain in
computer code program integrity breaches.
 Host-based Intrusion detection systems stay unaffected by
switched networks. [3]
Disadvantages of using Host based Intrusion detection
system
 Host based Intrusion detection system will be disabled by
bound DoS attacks.
 Host based Intrusion detection system are not well suited
for detecting attacks, those targets an entire network.
 Host primarily based Intrusion detection systems area unit
troublesome to manage, as for each individual system;
information is organized and managed [3].
V.DETECTION TECHNIQUES
The parts of intrusion detection system are date source,
evaluation engine and response manager. The data source
contains two categories namely host based and network based.
The analysis engine gets the information from the data source
and analyzes the attacks. The response manager detects the
attacks and gives response to the corresponding users. The
Intrusion detection has two categories for detecting attacks in
the network or host. They are Anomaly and Misuse detection.
[4]
A. Anomaly Detection
This detection approach is evaluating person’s present
behavior with regular behavior which is already saved within
the database. It used to detect the unknown assaults. By
utilizing statistical strategies to search out patterns of activity
that seems to be irregular [4]. However the purpose of
anomaly detection system is to search out the intrusion within
the system well timed. The purpose of anomaly detection is to
establish cases which might be uncommon within information
that's seemingly homogeneous. Anomaly detection is vital
software for detecting fraud, network intrusion, and different
uncommon occasions which will have nice significance
however are onerous to search out.[5]
B. Misuse Detection
This sort of detection approach system use patterns of well-
known assaults of the system to match and establish identified
intrusions [4].The misuse detection system is ability to detect
only the known attacks which already stored in the database
and generate the fewer false alarm rates. The disadvantage of
this system is unable to detect the newly invented attacks.
VI. INTRUSION DETECTION SYSTEM PRIOR
WORKS
Ektefa [7] compared C4.5 & SVM to indicate performance of
each algorithmic program and much values too. Among these
two C4.5 works higher compared to alternative. Since the
performance of a classifier usually evaluated by an error rate
and it doesn't suit the advanced real issues, specifically
multiclass.Holden [8] has projected hybrid PSO algorithmic
rule which will trot out nominal attributes while not going for
the each conversion and nominal attribute values. To beat the
disadvantage (features) that the PSO/ACO algorithmic rule
lacks. The projected technique shows straightforward rule set
with efficiency to extend in accuracy.Likewise Ardjani [9]
applied SVM with PSO as (PSO-SVM) to optimize the
performance of SVM. 10-Fold cross validation is completed to
estimate the accuracy. It utilizes the advantage of minimum
structural risk with international optimizing options. The result
shows higher accuracy with high execution time. Since there
[10] is an existence of multidimensional knowledge set, it's
necessary to extract the options and conjointly to get rid of the
redundant and inconsistent options that effects classifications.
Supported this, info gain and genetic formula has been
combined to pick out the many options. This methodology
shows higher accuracy once options area unit selected than
severally applied. Panda [11] uses two category classification
methodology in terms of traditional or attack. The combination
of J48 and Radial Basis Function (RBF) shows a lot of error
prone and RMSE rate. Compared to the current, Nested
Dichotomies and random forest methodology show 0.06%
error with a 99% detection rate. Petrussenko Denis [12]
involves Learning Rules for Anomaly Detection (LERAD) to
observe attacks in network packets and protocol flow to
capture a brand new style of attack patterns. He found LERAD
performs glowing with a DARPA dataset with high detection
rate.In [13] Mahoney used anomaly detection ways like Packet
header Anomaly Detector (PHAD), Application layer
Anomaly Detector (ALAD), LERAD to model the application
layer, data link layer and then on. Out of that LERAD
performs glowing.
TABLE.1.Comparative Analysis
SNORT [14] is tested on IDEVAL data set and attacks area
unit tabled daily nearly for one week. SNORT, SNORT with
PHAD, SNORT with NETAD and SNORT is additionally

4. Integrated Intelligent Research(IIR) International Journal of Business Intelligent
Volume: 04 Issue: 02 December 2015,Pages No.57- 61
ISSN: 2278-2400
60
combined with PHAD and Network Traffic Anomaly Detector
(NETAD) as a preprocessor. As a result, SNORT + PHAD +
NETAD observe nearly 146 attacks from 201 attacks
severally.
Unsupervised method [15] uses an enormous set of
information as pre-labeled coaching data and produces less
accuracy. To beat this issue, a semi-supervised formula is
employed.
VII. CHALLENGES IN INTRUSION DETECTION
SYSTEM
A. Human intervention
IDS technology itself is experiencing lots of enhancements.
It’s thus important for organizations to obviously outline their
prospect from the IDS implementation. Until currently IDS
technology has not achieved tier wherever it doesn't need
human interference. In fact today's IDS technology
recommends some automation like news the administrator just
in case of detection of a malicious activity, avoiding the
malicious association for a configurable amount of your time,
dynamically changing a router's access management list so as
to stop a malicious association etc. Thus the safety
administrator should investigate the attack once it's detected
and according, verify however it occurred, correct the matter
and take necessary action to stop the incidence of an
equivalent attack in future.
B. Historical Analysis
It is still important issue to observe the IDS logs often to
continue on high of the incidence of events. Observance the
logs on a routine are important to research the various kinds of
malicious activities detected by the IDS over an amount of
your time. Today's IDS has not nonetheless achieved the
amount wherever it will offer historical analysis of the
intrusive activities detected over a span of your time. This is
often still a manual activity. Hence it's very important for a
company to own a definite incident handling associated
response arrange if an intrusion is detected and reportable by
the IDS. Also, the organization ought to have skilled security
personnel to handle this type of state of affairs.
C. Deployment
The success of associate IDS implementation depends to an
outsized degree on however it's been deployed. Lots of arrange
is critical within the style additionally because the
implementation section. In most cases, it's needed to use a
fusion answer of network based mostly and host based IDS to
realize from each cases. If truth be told one technology
enhances the opposite. However, this call will dissent from
one organization to a different. A network based mostly IDS is
an immediate alternative for several organizations thanks to its
capability to watch multiple systems and additionally the
reality that it doesn't want a software system to be loaded on a
production system totally different from host based IDS.
Some organizations implement a hybrid answer. Organizations
putting in host based mostly IDS answer desires bear in mind
that the host based IDS software system is processor and
memory difficult. Thus it's vital to possess enough offered
resources on a system before establishing a bunch based
mostly sensing element on that.
D. Sensors
It is vital to take care of sensing element to manager
quantitative relation. There’s no strict rule in and of itself for
shrewd this quantitative relation. To an oversized degree it
depends upon what number differing kinds of traffic is
monitored by every sensing element and within which
background. Most of the organizations deploy a quantitative
relation of 10:1, whereas some organizations maintain 20:1
and a few others opt for 15:1. It is important to set up the
baseline strategy before beginning the IDS implementation
and avoid false positives. A poorly organized IDS sensing
element could post lots of false positive quantitative relations
to the console and even a quantitative relation of 10:1 or
perhaps enough higher sensors to the console ratio is missing.
E. Signature Database
A common policy for IDS in detective work intrusions is to
recollect signatures of well-known attacks. The inherent weak
points in hoping on signatures are that the signature patterns
should be acknowledged initial. New threats are usually
unrecognizable by eminent and in style IDS. Signatures are
often cloaked yet. The continuing event between new attacks
and detection systems has been a challenge. So the signature
info should be updated whenever a unique reasonably attack is
detected and repair for identical is accessible.
F. Monitor traffic in large networks
Network Intrusion Detection System (NIDS) elements square
measure noticed throughout a network, however if not placed
tactically, several attacks will altogether avoid NIDS sensors
by passing through alternate ways in which in an exceedingly
network. Moreover, though' several IDS product accessible
within the market square measure economical to differentiate
differing kinds of attacks, they will fail to acknowledge attacks
that use several attack sources. Several IDS cannot smartly
correlate knowledge from varied sources. Newer IDS
technologies should influence integrated systems to extend a
summary of distributed intrusive activity. Thus IDS should be
able to with success monitor traffic in an exceedingly giant
network.
VIII. CONCLUSION
This paper has studied the basic concepts of intrusion
detection system, need, components, types and challenges. The
intrusion detection system components are helpful to grasp the
method of detection. The IDS is combined with the algorithms
which identified the threats and provides immediate response
to the users.
REFERENCES
[1] SANS Institute Info Sec Reading Room, Intrusion Detection Systems:
Definition, Need andChallenges, © SANS Institute 2001, P.No 4
[2] Ambekari Tabassum Dawood, A.N.Mulla, International Journal of
Scientific and Research Publications, Volume 4, Issue 12, December
2014, ISSN 2250-3153, P.No 1
[3] Sonam Chourse, Vineet Richhariya, Survey Paper on Intrusion Detection
using Data Mining Techniques, International Journal of Emerging
Technology and Advanced Engineering, ISO 9001:2008 Certified
Journal, Volume 4, Issue 8, August 2014, ISSN 2250-2459, P.No 1
[4] Ruth D, Lovelin Ponn Felciah M, A Survey on Intrusion Detection
System with Data MiningTechniques, IJISET - InternationalJournal of

5. Integrated Intelligent Research(IIR) International Journal of Business Intelligent
Volume: 04 Issue: 02 December 2015,Pages No.57- 61
ISSN: 2278-2400
61
Innovative Science, Engineering & Technology, Vol. 1 Issue 3, May
2014, ISSN 2348 – 7968, P.No 2
[5] P.Kalarani, Dr.S. Selva Brunda, A Survey on Efficient Data Mining
Techniques for Network Intrusion Detection System (IDS), International
Journal of Advanced Research in Computer and Communication
Engineering Vol. 3, Issue 9, September 2014, ISSN 2319-5940,P.No 1
[6] Mostaque Md. Morshedur Hassan, Current Studies on Intrusion
Detection System, Genetic Algorithm and Fuzzy Logic, International
Journal of Distributed and Parallel Systems (IJDPS) Vol.4, No.2, March
2013, P.No 35
[7] Mohammadreza Ektefa, Sara Memar, Fatimah Sidi, LillySuriani
Affendey. Intrusion detection using data mining techniques. In:
International conference on information retrieval and knowledge
management; 2010. P. 200-4.
[8] Holden Alex Nicholas, Freitas A. A hybrid PSO/ACO algorithm for
discovering classification rules in datamining. J Artif Evol Appl
2008;2:1-11
[9] Ardjani Fatima, Sadouni Kaddour. Optimization of SVM multiclass by
particle swarm (PSO-SVM). J Mod Educ Comput Sci 2010; 2:32-8
[10] Sethuramalingam S. Hybrid feature selection for network intrusion. Int J
Comput Sci Eng 2011; 3(5):1773-9
[11] Mrutyunaya Panda, Ajith Abraham, Manas Ranjan Patra. A hybrid
intelligent approach for network intrusion detection. In: International
conference on communication technology and system design, procedia
engineering, vol. 30; 2011. P. 1-9
[12] Petrussenko Denis, Incrementally learning rules for anomaly detection.
CS-2009-02. Florida: Florida Institute of Technology Melbourne; 2009
[13] Matthew incent Mahoney. A machine learning approach to detecting
attacks by identifying anomalies in network traffic. TRCS-2003-13,
Melbourne, Florida; 2003
[14] Mahoney Matthew V, Chan Philip K. PHAD: packet header anomaly
detection for identifying hostile network traffic. In: Technical report CS-
2001-04. Florida Institute of Technology; 2001
[15] Gao Xiang, Wang Min. Applying Semi-supervised cluster algorithm for
anomaly detection. In: IEEE international symposium on information
processing, no. 3; 2010.