The base-rate fallacy and its implications for the difficulty of intrusion detection

Many different demands can be made of intrusion detection systems. An important requirement is that an intrusion detection system be effective ; that is, it should detect a substantial percentage of intrusions into the supervised system, while still keeping the false alarm rate at an acceptable level. This article demonstrates that, for a reasonable set of assumptions, the false alarm rate is the limiting factor for the performance of an intrusion detection system. This is due to the base-rate fallacy phenomenon, that in order to achieve substantial values of the Bayesian detection rate P(Intrusion***Alarm) , we have to achieve a (perhaps in some cases unattainably) low false alarm rate. A selection of reports of intrusion detection performance are reviewed, and the conclusion is reached that there are indications that at least some types of intrusion detection have far to go before they can attain such low false alarm rates.

The development of tools for automated analysis of data collected for mine countermeasures (MCM) search, classify and map (SCM) has predominantly focused on automated target recognition for individual mines. As MCM target detection becomes more automated, detecting spatial patterns in the positioning of mines should follow. Natural restrictions on mine deployment such as depth and bottom contour as well as mine deployment methodology and protocol effectively create mine line patterns that are typical to coastal areas. We have developed a mine line detection algorithm that uses nonparametric spatial analysis to identify mine-like contacts (MLCs) that fit into mine line patterns dictated by standard mine laying protocol in coastal regions. In general, a set of MLCs reported from a mine detection sensor will consist of both actual mines and false alarms; the algorithm classifies every MLC in this set into one of three classes: fixed — the MLCψfits into a mine line pattern with fixed mine spacing; random -the MLCψfits into a mine line pattern with random mine spacing; or false alarm-ψ-the MLCψdoes not fit into a mine line pattern and is subsequently not considered a mine. The latest version of the algorithm utilizes nonparametric techniques and requires no knowledge of either the detection sensor's probability of detection (P d ) or probability of false alarm (P fa ). A nonparametric anomaly detector first identifies regions with unusually high MLC density for more detailed analysis. Suspected regions are subsequently analyzed for unusually regular patterns of MLCs. The probabilities that the observed target densities and target patterns could occur simply by chance are estimated by comparison with results from nearby areas using basic information about mine deployment. To ensure that a mine line's full extent is captured, the algorithm attempts to grow a line after it is detected. And a more detailed probability analysis distinguishes random mine lines from fixed-spaced mine lines. Extensive Matlab simulations characterize the algorithm's performance across a wide range of operating environments and simulated minefield configurations. In total, ten replications each of 1,367 different configurations have been evaluated. These configurations include three different water depths (10 ft., 6 ft. and 200 ft.), six false notional alarm rates (1, 2,5,10,15 and 20 false alarms per sq. NM), three false alarm distributions (uniform, sloped, and striped), three sensor probabilities of detections (0.4, 0.6 and 0.9), three target confidence scores (0.6,0.8 and 1.0) and four false alarm confidence scores (0.5, 0.6, 0.8 and 1.0). The range of simulation parameters was selected in part as an attempt to push the algorithm past its acceptable performance limits. However, the algorithm performed remarkably well even under the worst conditions. For MLC sets with false alarm rates as high as 20 per square nautical mile, the algorithm correctly classifies over 98% of the MLCs as mines and detects 97% of the mine lines. Furthermore, it reduces the false alarm rate from 20 to 0.2 per square nautical mile with a false mine line rate of 0.14 false lines per square nautical mile. The algorithm achieves even lower false alarm rates when the initial false alarm rate is less than 20. The automated mine line detection discovers many obscure lines that are virtually undetectable to the naked eye.

Pulse oximetry provides a simple, continuous, noninvasive assessment of arterial blood oxygen saturation. Introduced by Nicolai [1] in 1932, oximetry did not gain widespread acceptance until the 1970s, when it was first reported that arterial hemoglobin oxygen saturation could be measured by analysis of pulsatile blood flow [2]. The pulse oximeter operates by measuring the attenuation of red (660 nm) and infrared light (940 nm) as it passes through a pulsatile tissue bed. Pulsatile blood flow is essential to allow differentiation of arterial from other absorbers of light such as venous and capillary blood components, as well as overlying tissue and skin [2]. Conceptually, the value of pulse oximetry is in identification and correction of hypoxemic events, which, if untreated, could result in serious complications such as brain injury, cardiac arrest, or death [3]. In a review of anesthetic-related, closed malpractice claims, Tinker et al. [4] stated that 31.5% of cases with adverse outcomes could have been prevented through additional monitoring. Eichhorn [5] in a review of 1,001,000 ASA physical status I and II patients, found 11 major intraoperative accidents that could have been attributed solely to anesthesia; seven were deemed preventable. Unrecognized hypoventilation was the most common intraoperative event associated with severe patient injury. Other extensive clinical series document that pulse oximetry increases the identification of hypoxemic events [6,7]. Although pulse oximetry is now well established, the technology has not been greatly improved since 1988 [8], and a number of limitations persist. Kestin et al. [9] reported that 75% of all auditory alarms during routine anesthesia did not originate from changes in physiological variables and only 3% represented patient risk. Freund et al. [10] reported 11,046 cases, with a 1.12% failure rate, defined as the inability to obtain any pulse oximetry reading for a cumulative period of 30 minutes or more after all mechanical problems had been eliminated. A higher rate of failure was present in elderly patients, those with ASA physical status III, IV, and V, and during long or emergency operations. An algorithm developed by Timcenko and Reich [11] predicted a more frequent rate of pulse oximetry failure depending on patient age, ASA physical status, body temperature (<35 degrees C or >37 degrees C), and type of operation (cardiopulmonary bypass, vascular, and orthopedic operations), while Moller et al. [6], by analysis of data from 20,802 patients, identified a total failure rate of 2.5%, increasing to 7.2% in ASA physical status IV patients. A comprehensive review by Severinghaus and Kelleher [8] determined that failure of pulse oximetry could often be explained in terms of low signal-to-noise ratio due to either inadequate signal (e.g., low perfusion, vasoconstrictor use, improper probe placement) or excessive noise (e.g., motion, ambient light, electrocautery, venous pressure waves). Thus, technological evolution recently has been focused on improving function by optimizing the signal-to-noise ratio [12-21] and decreasing the frequency of false alarms [22-24]. Pan and James [23] found that incorporation of a 60-second delay could reduce the false alarm frequency by 88%. However, during a true hypoxemic event, such a delay would reduce the time available for intervention. Egbert et al. [24] developed a neural network pattern classifier for detecting artifact in pulse oximetric signals. Using factor analysis to differentiate pulse oximetry waveforms, they correctly classified 91.4% of the corrupted waveforms and 72.7% of the clean waveforms used to train the network, suggesting that further improvements in signal analysis could reduce artifact and improve performance. Artifact due to motion also can be reduced by coupling an electrocardiograph to the oximeter signal [25]. In this issue, Dumas et al. [12] report the use of another technological advance, Masimo signal extraction technology (SET Trademark), to differentiate the "true" signal from artifact during low perfusion and motion. Recent studies have demonstrated that this technique may have a significantly lower failure rate and a lower false positive alarm rate [12,18,19,21] than conventional oximetric monitoring. Dumas et al. evaluated a prototype Masimo SET Trademark pulse oximeter in 50 ASA physical status I-IV patients in the postanesthesia care unit and found a lower failure rate and a lower frequency and duration of false alarms when compared with conventional pulse oximetry. A similar prototype also alarmed less frequently than a conventional oximeter during inflation of a blood pressure cuff [17]. At present, Masimo SET Trademark awaits Food and Drug Administration approval, although the manufacturers anticipate that the technique will be available for general marketing in late 1996. As anesthesiologists, should we anticipate that this technological advance will improve pulse oximetry sufficiently to advance clinical practice? The answer may vary, depending upon the circumstances in which oximetry is used. In daily practice, the two most annoying limitations of current technology are signal failure in patients with poor peripheral perfusion and signal artifact in patients who have distal extremity movement. Masimo SET Trademark does little to improve the first problem; however, movement artifact complicates pulse oximetry in the postanesthesia care unit and intensive care unit and during emergence from general anesthesia. Anecdotally, the frequency of false alarms is sufficiently high that many personnel are desensitized; they regard a desaturation on pulse oximetry as artifactual until proven otherwise. Perhaps many of us have witnessed delays in treatment because "we didn't trust the monitor!" The Masimo SET Trademark should increase confidence in the validity of alarms, as it increased the incidence of true positive alarms from 12% to 41%. Perhaps our practice will be a bit improved. How much additional cost is justified? Perhaps a bit. However, any technological improvement in pulse oximetry can represent only a small incremental improvement on an enormous advance--and the enormous advance has been shown to make no apparent difference in clinical outcome [6,7].

The amount of data in the field of computer networking is growing rapidly and this urges new challenges in the field of an intrusion detection system (IDS). To handle such increasing volume of data, a new hybrid approach has to be developed to overcome the problems such as high detection rate and low false alarm rate. An intrusion detection system plays a vital role in the detection of malicious attacks. Data mining and machine learning techniques are important and play a vital role in the detection of attacks. This paper mainly focuses on detection rate and false alarm rate and so to resolve these problems a hybrid method, ensemble clustering, has been proposed. This method tries to increase detection rate with lowering false alarm rate. The method has been tested on KDDCup'99 network intrusion dataset and performs well as compared with other algorithms in terms of detection rate and false alarm rate.

A lane departure warning system (LDWS) should give as much warning time as possible, while triggering few, if any, false alarms. In this paper, a virtual lane boundary based LDWS (VLWM) is proposed to approach this goal. VLWM allows the driver to drift beyond the physical lane boundary by adding a virtual lane boundary. Accounting for the driving habit of the driver, lane geometry, and the local driver behavior changes, the virtual lane width is determined using a fuzzy-logic inference method. When the vehicle is predicted to exceed the virtual lane boundary, an alarm is triggered. Real world driving data are used to test the LDWSs. Compared with time-to-lane-crossing (TLC) based method, the VLWM has a much lower false alarm rate, while their warning time is almost similar. Meanwhile, VLWM has a much longer warning time than the roadside rumble strip (RRS), while the false alarm rate is almost as low as that of the RRS.

A novel semantic Minimum Bayes ternary hypothesis detector based on the Rayleigh distribution is presented to decrease detection false alarm rate of synthetic aperture radar image. The method not only employs the strong scattering features of the target which is used in constant false alarm rate (CFAR) but employs the shadow features of the target which is used in the Power Ratio detector. Furthermore, target, shadow, and clutter regions are merged into the ternary image to estimate Rayleigh distribution parameters and weights. Meanwhile, the semantic relationship between the strong scattering features and the shadow features is established to partly reduce the false alarm targets. By the experiments on the Mini-SAR image of the 4-in resolution, it is shown that our method outperforms the semantic CFAR method and CFAR algorithm by a much lower false alarm rate.

Due to the prevalence of Wireless Sensor Networks (WSNs) in the many mission-critical applications such as military areas, security has been considered as one of the essential parameters in Quality of Service (QoS), and Intrusion Detection System (IDS) is considered as a fundamental requirement for security in these networks. This paper presents a lightweight Intrusion Detection System to protect the WSNs against the most important of routing attacks in network layer based on their extracted specifications. The proposed IDS, in contrast to related works that often focuses on a specific attack, covers almost all recognized important routing attacks in WSNs. With the full simulation of the routing attacks and the careful examination of their behavior, we extracted key specifications to identify them in the proposed system. Also, due to local operations provided to detect and significantly reduce communications, the proposed method is a lightweight approach. Another advantage of the proposed method is reducing false alarms rate by applying appropriate thresholds. We considered all performance criteria to evaluate and compare the proposed method. Simulation results show that the proposed system is an effective and lightweight IDS in WSNs due to high detection accuracy, low false alarms rate, and low power consumption.

In human presence detection for Internet of Things (IoT) applications, Wi-Fi channel state information (CSI)-based methods offer significant advantages in cost-effectiveness and privacy preservation. Existing approaches typically rely on feature engineering or deep learning techniques to process CSI data. However, these methods often struggle to accurately model the complex, probabilistic nature of CSI measurements, particularly in environments with nonhuman moving elements. This leads to suboptimal detection probabilities under low false alarm rate (FAR) conditions. Therefore, this article introduces Wi-CCFAR, a controllable FAR human presence detector utilizing Wi-Fi CSI data. First, we employ a normalizing flow network with spline transformations for data modeling, capturing the complexity of CSI measurement distribution. Second, to address the inherent limitation of the same input and output dimensions in normalizing flow networks, we introduce an efficient feature extractor, which reduces input dimensions and computational requirements while maintaining high detection probabilities by preserving essential information. Last, we implement an enhanced information bottleneck loss function, which balances data fitness and class divergence, to achieve favorable detection probabilities under low FAR conditions. Experimental results demonstrate that Wi-CCFAR outperforms conventional methods, achieving higher detection probabilities with lower false alarm probabilities, even in challenging scenarios with various interferences such as moving objects and multiple occupants.

This paper presents a multi-mode fusion algorithm for detection and tracking of dim, point-like target. The key contribution of this paper includes the effective fusion approach to harvest the advantages and complement the disadvantages of various algorithms using conditional voting. From qualitative analysis, these algorithms are separated into two classes, i.e. main and supporting algorithms. In the multi-mode fusion algorithm high confidence is placed on the main algorithms with supporting algorithms used to further reduce the false alarm. The main algorithms trigger a voting process and detection is confirmed true if any of the supporting algorithms report detection. The multi-modal fusion algorithm has lower false alarm and moderate true detection rate compared to any individual algorithm namely, Triple Temporal Filter, Frame Differencing, Continuous Wavelet Transform, Max-median and 2-D Mexican hat filter. Besides, a novel variability filter is proposed to remove strong glint thus reduces false alarm. Kalman filter is used to track the detected targets. A novel track decision algorithm to continue or terminate the track when target disappears is proposed. Prior knowledge of target in Kalman filter is fed forward to an Adaptive 3-D Matched filter to improve the performance. Three sets of real-world infrared image sequences with very different background and target characteristics were used to test the robustness of the multi-modal fusion algorithm. The algorithm performs satisfactorily in all the image sequences. Video clips will also be presented.© (2003) COPYRIGHT SPIE--The International Society for Optical Engineering. Downloading of the abstract is permitted for personal use only.

Multi-pass search and reconnaissance missions provide unique opportunities for hyperspectral target detection systems to operate at drastically reduced false alarm rates. In the simplest example, confirmed false alarms generated by an anomaly detector on an initial pass can be archived for future reference. A more sophisticated approach captures false alarm signatures to update background clutter models that inform detection algorithms. Or if detections are confirmed as targets on one pass, then matched-filter maps based on their spectra can be compared over time to monitor changes. As a final example, when sub-pixel registration is feasible, multi-temporal spectral covariance relations can be estimated from the data and used to detect anomalous changes at low false alarm rates, using no target signature information. All but the simplest of such methods require that the spectral evolution of a terrestrial background -- its chromodynamics -- be modeled sufficiently that naturally occurring changes are not confused with unnatural ones. This paper describes several detection paradigms that rely on multi-pass missions. Optimal linear algorithms to predict scene and target evolution are discussed, as are more realistic methods with relaxed operational requirements. One of these, called Covariance Equalization, is shown to perform nearly as well as the minimum error solution based on the matrix Wiener filter, which requires subpixel registration accuracy.

Intrusion Detection Systems (IDS) is one of the important aspects of cyber security that can detect the anomalies in the network traffic. IDS are a part of Second defense line of a system that can be deployed along with other security measures such as access control, authentication mechanisms and encryption techniques to secure the systems against cyber-attacks. However, IDS suffers from the problem of handling large volume of data and in detecting zero-day attacks (new types of attacks) in a real-time traffic environment. To overcome this problem, an intelligent Deep Learning approach for Intrusion Detection is proposed based on Convolutional Neural Network (CNN-IDS). Initially, the model is trained and tested under a new real-time traffic dataset, CSE-CIC-IDS 2018 dataset. Then, the performance of CNN-IDS model is studied based on three important performance metrics namely, accuracy / training time, detection rate and false alarm rate. Finally, the experimental results are compared with those of various Deep Discriminative models including Recurrent Neural network (RNN), Deep Neural Network (DNN) etc., proposed for IDS under the same dataset. The Comparative results show that the proposed CNN-IDS model is very much suitable for modelling a classification model both in terms of binary and multi-class classification with higher detection rate, accuracy, and lower false alarm rate. The CNN-IDS model improves the accuracy of intrusion detection and provides a new research method for intrusion detection.

Computer network defense (CND) protects organizations and individuals against cyber threats by monitoring, identifying, analyzing, and defending network infrastructure from infiltration. Network defenders must maintain high levels of cyber situation awareness (CSA) in order to correctly identify and act on threats to the network. Intrusion detection systems (IDSs) are automated systems designed to assist network defenders in building CSA by sifting through network traffic and flagging potential threats. These systems are plagued by high false alarm rates that inhibit the ability of network defenders to build CSA. More capable IDSs have been developed that are capable of increasing the hit rate and lowering the false alarm rate by analyzing gathered network information. The influence of these IDS technologies on CSA has yet to be explored. 172 San Jose State University psychology students performed a signal detection task for intrusion detection to examine whether integrated automation with a multilayered analysis incorporating both liberal and conservative response criteria leads to better CSA than less-integrated, yet liberally responding automation (high hit rates and high false alarm rates) or conservatively responding automation (with low hit rates and low false alarm rates). The IDS condition was manipulated at three levels (liberal, conservative, both). The reliability of the IDSs was manipulated at three levels (60%, 80%, 95%). This study was unable to observe any differences in task performance or CSA for any of the conditions.

Intrusion detection is a mechanism of providing security to computer networks. Almost all of traditional intelligent intrusion detection systems (IDSs) use a single approach to distinguish normal behavior patterns from attack signatures. Moreover these systems have a high false alarm rate and high cost. The combination of multiple classifiers usually exhibits lower false alarm and overall error rate than individual decisions. On the other hand, the combination of classifiers trained on different feature sets could provide better performances than each single classifier. In this paper, a hierarchical two-level combiner is proposed to detect network intrusions using multiple well-known and efficient base classifiers. The proposed combiner exploits the different recognition capabilities provided by the independent feature representations in the first level as well as the agreement among the classifiers in the second level.

The performance of a radar detector may become inaccurate when key parameters of the system are imprecise. Imprecise parameters are modeled here as fuzzy numbers. The fuzzy integrator detector is constructed for a Rician target in Rayleigh background. Results indicate that the precision of the detection performance decreases as parameter imprecision increases. The false alarm rate is particularly sensitive to parameter imprecision at low false alarm rate; 5% imprecision in the parameters can give rise to more than 300% imprecision in the false alarm rate at nominal false alarm rates below 10/sup -5/.

We introduce a social network analysis method as a new approach to build an Intrusion Detection System (SN-IDS) in ad hoc networks. The SN-IDS utilizes social relations as metrics-of-interest for anomaly detections, which is different from most traditional IDS approaches. To construct proper social networks, we first investigate ad hoc MAC and network layer data attributes and select relevant social feature sets; then we build up a set of socio-matrices based on these features. Social analysis methods are applied to these matrices to detect suspicious behaviors of mobile nodes. NS-2 simulation results show that this SN-IDS system can effectively detect common attacks with high detection rates and low false positive alarm rates. Furthermore, it has clear advantages over the conventional association rule based data mining IDS in terms of computation and system complexity.