Abstract

Huge amounts of network traces can be collectedfrom today’s busy computer networks. Analyzing thesetraces could pave the way to detect unusual conditionsand/or other anomalies. Presently, due to the lack of effectivesubstantiating mechanisms intrusion detection systems oftenexhibit numerous false positives or negatives. The efficiencyof a network intrusion detection system (NIDS) dependsvery much on detecting and effectively validating the detectedanomalies. Furthermore, most NIDSs do not haveproven mechanisms that will easily accommodate legitimatedynamic changes. Achieving dynamic adaptation in realtime has been a long standing desire for effective intrusiondetection and prevention. Real time detection of outliers is afeasible option to substantiate anomalies in large data sets,leading to effective intrusion detection and prevention. Inthis context we propose and investigate a novel mechanismto detect intruders and to classify security threats usinggroup outliers. Our system monitors for timing and/orbehavioral anomalies and uses outlier based techniquesto substantiate the anomaly. In this paper we introducethe concept of Group Outlier Score (GOS) and its use insubstantiating security threats in wireless networks. We havetested the concept on our experimental wireless networkingenvironment. The analysis of the results reveals that witha threshold value of 1.2 for GOS our system demonstratesoptimum performance.