Fortifying Network Security via Intelligent Traffic Analysis with Hybrid IDS

With growth in technology, hacking and cyberattacks have increased hence the importance of network security. They also do not cease to invent new ways of penetrating the network, hence the need to install measures such as the IDS. This paper deals with improvement of IDS by combining signature based and anomaly based detection on packet data in Zeek (previously known as Bro). Autoencoder method focuses on the finding of intrusion in the network traffic while the signatures based method on the detection of known threat by matching the traffic with the existing signatures. This two-pronged approach is expected to enhance the chances of accurate detection while at the same time mitigating on the possibilities of having false alarms. The experiments showed that the average percent of accuracy to be nearly 88%, which proved that the system is capable of detecting both established and novel threats. The results showed that the anomaly-based method could successfully identify new threats with minimum number of false alarms and the signature based approach could locate the known threats perfectly. Altogether, these methods add more layers of protection to the network against today’s ever-changing threats.