Multistage process to decrease processing time in intrusion prevention system

Abstract

Distributed Denial of Service (DDoS) attack growing larger as growing advance of internet technology and scale. Traffic Anomaly-based Intrusion Detection/Prevention System (IDS/IPS) has proposed as its capability to detect DDoS attack. Unfortunately, the anomaly detection algorithm was limited to detect the existence of an attack. To determine the type of attack, the system must occupy multiclass classification algorithm. However, the complexity of distance-based classification algorithm is always higher than detection algorithm. This research view IPS as one integrated sequence of detection, classification, and prevention process. We propose a multi-stage IPS with the used of distance-based anomaly detection analysis in the first stage, and classification analysis in later stages. The simulation result shows lower processing time of the IPS, with a capability of choosing a certain action for certain type of DDoS attack.