Using Triple Modular Redundancy for Threshold Determination in DDOS Intrusion Detection Systems

Abstract

This paper describes an Intrusion Detection System (IDS) which uses several existing known IDS algorithms and Triple Modular Redundancy (TMR) algorithm to make decision about eventual existing attack by majority voting in one constructed ensemble model which solves practically the problem of binary classification. Proposed novel model belongs to so called stacking ensemble methods of machine learning algorithms which uses exactly four algorithms from the group of best binary classification algorithms: Decision trees, Naive Bayes, Support Vector Machine, k-nearest neighbors, logistic regression and AdaBoost and is applicable for any similar problem. Using proposed method, we get a more precisely determined threshold than it is case using whatever of in method individual applied algorithm as well as those algorithms that are the state of the art in the field of binary classification. Besides that, one of the main disadvantages of classic TMR used for classification network traffic, which is the problem of bad over-voting was successfully avoided by improving classic TMR with a new algorithm proposed by the authors. Today a denial of service attacks (DoS) and distributed denial of service (DDoS) are one of most present type on Internet and that is why the authors in this paper paid special attention to them and because of that the authors of proposed method chose to use known KAGGLE dataset which contains data of these type of attacks for the examination of quality of proposed IDS method implemented in suitable software. The dataset itself consists of a wide range of simulated intrusions in a military network environment in United States. Obtained results showed that IDS software with implemented proposed method worked precise and timely, which means alarms was trigger properly and efficiently with better results of quality of classification in most important measures than the individual included algorithms who are the state of the art in binary classification.

Keywords

• IDS
• DoS
• DDoS
• triple modular redundancy
• bad over-voting problem
• Kaggle