Hybrid Log Intrusion Detection: Combining Anomaly Detection with Snort Signatures for Host Security

Abstract

In this paper, we describe the design of a hybrid log-based IDS using anomaly-based and signature-based techniques for host security in Python. The aim is to take advantage of the complementary strengths of anomaly detection for novel threats and signature detection for known threats in order to increase both the coverage and accuracy of detection. The system leverages machine learning algorithms to model normal log behavior and detects anomalies, and integrates the Snort (open-source IDS) signature engine to catch known attacks. The synergy between anomaly detection and signature analysis seeks to cover zero-day attacks and known exploits so as to mitigate the limitations of each approach on its own..We have validated the performance of the hybrid IDS using some public intrusion detection benchmark datasets such as the KDD Cup 99 dataset. The experimental results are quite impressive-the combined approach shows higher detection rates and a lower false-positive rate compared to standalone anomaly or signature-based. These findings have hence established that our hybrid IDS, written in Python, can substantially enhance threat detection and reduce false alarms. This has been achieved by successfully fusing machine learning-driven anomaly detection with Snort-based signature analysis for host intrusion detection.