Detection of Low Intensity DoS Attacks using Fuzzy Based Intrusion Detection System

Detecting low intensity denial of service (DoS) attacks in minimum time with less false positives is challenging for network based intrusion detection systems. In this paper we propose a new fuzzy logic based approach, which adapts fuzzy linguistic membership functions instead of modifying the fuzzy rules. The authors use the normal TCP profile, i.e. the `connected-sessions', to guide the fuzzy membership set boundaries. The authors also propose implementation architecture with a hierarchy of fuzzy agents responsible for detecting different types of attacks. This scheme reduces the number of false alarms at lower level of hierarchy. Tests have been conducted and are reported using DARPA98 datasets