A Survey and Taxonomy of Classifiers of Intrusion Detection Systems

Tarfa Hamed, Jason B. Ernst, Stefan C. Kremer

Abstract: In this chapter, a new review and taxonomy of the classifiers that have been used with intrusion detection systems in the last two decades is presented. The main objective of this chapter is to provide the reader with the knowledge required to build an effective classifier for IDSs problems by reviewing this phase in component-by-component structure rather than paper-by-paper organization. We start by presenting the extracted features that resulted from the pre-processing phase. These features are supposed to be supplied to the pattern analyzer, and therefore different types of analyzers are presented. We discuss also the knowledge representation that is produced from these pattern analyzers. In addition, the decision making component (of IDS) which we called here detection phase is also presented in details with the most common algorithms used with IDS. The chapter explores the classifier decision types and the possible threats with their subclasses. The chapter also discusses the current open issues that face pattern analyzers that work in adversarial environments like intrusion detection systems and some contributions in this field. The components discussed in this chapter represent the core of the framework of any IDS.