Selection of intrusion detection system threshold bounds for effective sensor fusion Ciza Thomas, * Narayanaswamy Balakrishnan Supercomputer Education and Research Centre, Indian Institute of Science, Bangalore, India-560 012 abstract The motivation behind the fusion of Intrusion Detection Systems was the realization that with the increas- ing traffic and increasing complexity of attacks, none of the present day stand-alone Intrusion Detection Systems can meet the high demand for a very high detection rate and an extremely low false positive rate. Multi-sensor fusion can be used to meet these requirements by a refinement of the combined response of different Intrusion Detection Systems. In this paper, we show the design technique of sensor fusion to best utilize the useful response from multiple sensors by an appropriate adjustment of the fusion threshold. The threshold is generally chosen according to the past experiences or by an expert system. In this paper, we show that the choice of the threshold bounds according to the Chebyshev inequality principle performs better. This approach also helps to solve the problem of scalability and has the advantage of failsafe capability. This paper theoretically models the fusion of Intrusion Detection Systems for the purpose of proving the improvement in performance, supplemented with the empirical evaluation. The combination of complementary sensors is shown to detect more attacks than the individual components. Since the individual sensors chosen detect sufficiently different attacks, their result can be merged for improved performance. The combination is done in different ways like (i) taking all the alarms from each system and avoiding duplications, (ii) taking alarms from each system by fixing threshold bounds, and (iii) rule-based fusion with a priori knowledge of the individual sensor performance. A number of evalua- tion metrics are used, and the results indicate that there is an overall enhancement in the performance of the combined detector using sensor fusion incorporating the threshold bounds and significantly better performance using simple rule-based fusion. Keywords: Intrusion Detection Systems (IDS), Anomaly-based IDS, True Positive (TP), True Negative (TN), False Positive (FP), False Negative (FN), Sensor Fusion, Chebyshev Inequality 1. introduction IDS gathers information from within a computer or a network, and analyzes this information to identify possible security breaches against the system or the network. For the detection of external intrusion activities, if there are multiple paths to the Internet, an IDS needs to be present at every entry point, whereas for the detection of internal intrusion activities, an IDS is required in every network segment. Sensor Fusion can be defined as the process of collecting information from multiple and possibly heterogeneous sources and combining them to obtain a more descriptive, intuitive and meaningful result 1 . The fusion technique works well in the case of sensors having some extent of similarity between them. Hence we have concentrated in this work on the anomaly-based sensors which detect anomalies beyond a set threshold level in the features it detects. Threshold bounds instead of a single threshold give more freedom in steering system properties. Any threshold within the bounds can be chosen depending on the preferred level of trade-off * ciza@mmsl.serc.iisc.ernet.in; phone 91 80 2293 2896; fax 91 80 2293 3438