\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Review of Intrusion Detection Systems},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2017 2017-01-15 (revised: 14 Year 2017 15 January 2017)}
\def\TheID{\makeatother }
\def\TheDate{2017 2017-01-15}
\title{A Review of Intrusion Detection Systems}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Muchelule Yusuf  Wanjala}

             \author[2]{Neyole Misiko  Jacob}

             \affil[1]{  Jomo Kenyatta University of Agriculture and Technology 1}

\renewcommand\Authands{ and }

\date{\small \em Received: 12 December 2016 Accepted: 31 December 2016 Published: 15 January 2017}

\maketitle


\begin{abstract}
        


An intrusion detection system (IDS) are devices or software?s that are used to monitors networks for any unkind activities that bridge the normal functionality of systems hence causing some policy violation. This paper reviews some of the intrusion detection systems and software?s highlighting their main classifications and their performance evaluations and measure.

\end{abstract}


\keywords{IDSs. performance measure and performance measures.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{I. INTRODUCTION}]{I. INTRODUCTION}\par
ntrusion Detection is the process of detecting actions that try to compromise the overall integrity and confidentiality of a resource. The goal therefore of intrusion detection is to identify accessors that attempt to intrude and compromise systems security controls. Current IDS examine the entire data features to detect any intrusion and misuse patterns, although some of the features may be redundant and may contribute less to the detection process \hyperref[b0]{[1]}. Current anomaly based intrusion detection systems and many other technical approaches have been developed and deployed to track novel attacks on systems. 98\% detection rates at a high and 1\% at a low alarm rate can therefore be achieved by using these techniques \hyperref[b1]{[2]}. This paper review the various intrusion detection systems by evaluating their performance measures.\par
According to V. Jyothsna \hyperref[b2]{[3]} there are three main types of intrusion detection systems: -signaturebased (SBS), anomaly-based (ABS) intrusion detection systems and Network Intrusion Detection System (NIDS). SBS systems such as Snort \hyperref[b2]{[3]}make use of pattern recognition techniques by maintaining the database of signatures of previously known attacks to compare them with newly analyzed data. An alarm is raised when similarities are established. On the other hand ABS systems such as PAYL \hyperref[b3]{[4]} build a statistical model to describe the normal network traffic, where any abnormal behavior that deviates from the model are identified. On the contrary anomaly-based systems have the advantage that they can detect zero-day attacks \hyperref[b1]{[2]}. 
\section[{a) Signature based Detection}]{a) Signature based Detection}\par
With the explosion of internet commerce, e-business services on the web, e-banking and other high profile applications, organizations providing this services need to prepare themselves to the best possible protection against unauthorized penetration  {\ref [5]}. Signature detection involves searching network traffic for a series of malicious bytes or packet sequences. The main advantage of this technique is that signatures are very easy to develop and understand if we know what network behavior we are trying to identify. The events generated by signature based IDS can communicate the cause of the alert. As pattern matching can be done more efficiently on modern systems so the amount of power needed to perform this matching is minimal for a rule set. This technique can be easily deceived because they are only based on regular expressions and string matching. These mechanisms only look for strings within packets transmitting over wire. More over signatures work well against only the fixed behavioral pattern, they fail to deal with attacks created by human or a worm with self-modifying behavioral characteristics. Signature based detection system (also called misuse based), this type of detection is very effective against known attacks, and it depends on the receiving of regular updates of patterns \hyperref[b4]{[6]}. But signature based detection does not work well when the user uses advanced technologies like NOP generators, payload encoders and encrypted data channels. The efficiency of the signature based systems is greatly decreased, as it has to create a new signature for every variation. As the signatures keep on increasing, the system engine performance decreases. Due to this, many intrusion detection engines are deployed on systems with multi processors and multi Gigabit network cards. IDS developers develop the new signatures before the attacker does, so as to prevent the novel attacks on the system. The difference of speed of creation of the new signatures between the developers and attackers determine the efficiency of the system \hyperref[b1]{[2]}. 
\section[{b) Anomaly based Detection}]{b) Anomaly based Detection}\par
An anomaly-based intrusion detection system is an intrusion detection system for detecting both network and computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. The classification is based on heuristics or rules, rather than patterns or signatures, and attempts to detect any type of misuse that falls out of normal system operation. This is as opposed to signature-based systems, which can only detect attacks for which a signature has previously been created \hyperref[b6]{[7]}. The anomaly based detection is based on defining the network behavior. The network behavior is in accordance with the predefined behavior, then it is accepted or else it triggers the event in the anomaly detection. The accepted network behavior is prepared or learned by the specifications of the network administrators.\par
The important phase in defining the network behavior is the IDS engine capability to cut through the various protocols at all levels. The Engine must be able to process the protocols and understand its goal. Though this protocol analysis is computationally expensive, the benefits it generates like increasing the rule set helps in less false positive alarms. The major drawback of anomaly detection is defining its rule set. The efficiency of the system depends on how well it is implemented and tested on all protocols. Rule defining process is also affected by various protocols used by various vendors. Apart from these, custom protocols also make rule defining a difficult job. For detection to occur correctly, the detailed knowledge about the accepted network behavior need to be developed by the administrators. But once the rules are and protocol is built then anomaly detection systems works well. 
\section[{c) Network Intrusion Detection System}]{c) Network Intrusion Detection System}\par
NIDS are deployed on strategic point in network infrastructure. The NIDS can capture and analyze data to detect known attacks by comparing patterns or signatures of the database or detection of illegal activities by scanning traffic for anomalous activity. NIDS are also referred as "packet-sniffers", because it captures the packets passing through the of communication mediums \hyperref[b4]{[6]}. The network IDS usually has two logical components: the sensor and the management station. The sensor sits on a network segment, monitoring it for suspicious traffic. The management station receives alarms from the sensor(s) and displays them to an operator.\par
The sensors are usually dedicated systems that exist only to monitor the network. They have a network interface in promiscuous mode, which means they receive all network traffic not just that destined for their IP address and they capture passing network traffic for analysis. If they detect something that looks unusual, they pass it back to the analysis station. The analysis station can display the alarms or do additional analysis. A fundamental problem for network intrusion detection systems (NIDSs) that passively monitor a network link is the ability of a skilled attacker to evade detection by exploiting ambiguitiesin the traffic stream as seen by the NIDS \hyperref[b7]{[8]}. 
\section[{III.}]{III.} 
\section[{IDS PERFORMANCE EVALUATION}]{IDS PERFORMANCE EVALUATION}\par
The majority of published documents claiming to evaluate IDSs are conducted as comparisons, rather than evaluations. Evaluation should be considered to be a determination of the level to which a particular IDS meets specified performance targets \hyperref[b9]{[9]}.The basic task in intrusion detection system is to classify network activities as normal or abnormal while minimizing misclassification \hyperref[b10]{[10]}. Many problems exist in IDS and need to be addressed, such as the low detection capability against the unknown network attack, high false alarm rate, and insufficient analysis capability. Generally, intrusion detection is targeted as classification problem, to distinguish between the normal activities and the malicious activities \hyperref[b11]{[11]}.\par
According to the NSS publication "Intrusion Detection Systems Group Test(2001), the evaluation of each IDS consists of two components. The first component is a qualitative analysis of the various features and functions of each product. The comments and analysis of the various features are well considered and unbiased \hyperref[b12]{[12]}. The group further established that the quantitative component of consisted of four tests of the NIDSs on a controlled laboratory network. These test focused upon specific performance indicators, attack recognition, performance under load, ability to detect evasion techniques and a stateful operation test.\par
The performance measures used by these evaluation were: a ratio of attack detection to false positive, ability to detect new and stealthy attacks, a comparison of host vs. network based systems to detect different types of attacks, the ability of anomaly detection techniques to detect new attacks, improvements between 1998 and 1999, and the ability of systems to accurately identify attacks. The research also attempted to establish the reason each IDS failed to detect an attack, or generated a false positive. Both the 1998 and 1999 evaluations identified a number of weaknesses with existing IDSs.\par
A number of these issues have since been resolved, while others are still valid. The testing process used sample of generated network traffic, audit logs, system logs and file system information. This information was then distributed to various evaluators who would provide the appropriate data to the Intrusion Detection Systems. This ensured each system was provided with identical data, whilst allowing proper configuration of each system. \hyperref[b13]{Ranum (2001)} extract established that constructing good benchmarks and tests for IDS was difficult and in order to accurately measure IDS complexity one needed to expand considerable efforts in designing tests by ensuring that the tests weren't inherently biased or inaccurate. This was a challenge to the IDS especially as they depend on operation environment. He further concluded that if tests were to be made they were to base on qualitative and comparative measures. In his summary he presented some experiences in benchmarking IDS with a focus on poorly designed tests and their effects. And a technology continue to advance the IDS management systems would become increasingly inefficient \hyperref[b13]{[13]}.\par
Alessandri \hyperref[b14]{[14]} proposed the use of a systematic description scheme for regulating the descriptions used to describe IDS functions. This approach should allow for an evaluation of IDSs based upon their descriptions, without necessitating experimentation. The disadvantage of this approach is the requirement of accurate descriptions. Currently such an approach does not exist so implementing it is not possible. This approach does hold a certain promise for the future. 
\section[{IV. PERFORMANCE MEASUREMENT CRITERIA a) Ability to Identify Attacks}]{IV. PERFORMANCE MEASUREMENT CRITERIA a) Ability to Identify Attacks}\par
The main performance requirement of a NIDS is to detect intrusions. However the definition of an intrusion is currently unclear. In particular, many vendors and researchers appear to consider any attempt to place malicious traffic on the network as an intrusion. In reality a more useful system will log malicious traffic and only inform the operator if the traffic possess a serious threat to the security of the target host. Snort is tending towards this direction with the use an alert classification ranging from 1 to 10. With 1 representing a point of interest only and 10 representing a major threat to security. 
\section[{b) Known vulnerabilities and attacks}]{b) Known vulnerabilities and attacks}\par
All NIDSs should be capable of detecting known vulnerabilities. However research indicates that many commercial IDS fail to detect recently discovered attacks \hyperref[b15]{[15]}  \hyperref[b12]{[12]}. On the other hand if a vulnerability or attack is known all systems should be patched, or workarounds applied thus the need for a NIDS to detect these events will be removed. Unfortunately the reality is that many systems are not patched or upgraded as vulnerabilities are discovered. This is clearly indicated by the number of system compromises that occur every day, and the fact that most of the problems on the SANS top twenty list are predominantly old well known problems, with fixes available. 
\section[{c) Stability Reliability and Security}]{c) Stability Reliability and Security}\par
Any IDS should be able to continue consistently operate in all circumstances. The application and operating system should be capable of running for years without segmentation faults or memory leakage. An important function of a NIDS is to consistently report identical events in the same manner. One disadvantage of a product using signature recognition is the ability of different users to configure different alerts to provide different messages. Thus traffic on one network may trigger a different alert to the same traffic on another system of the same type.\par
A number of efforts are currently underway to solve this problem. Both securityfocus and CVE provide databases of known vulnerabilities, and exploits targeting them. The system should also be able to withstand attempts to compromise it. If a attacker can identify a NIDS on a network it will could prove to be a valuable asset. It is also possible the attacker will attempt to disable the system using DoS or DDoS techniques. The system should be able to withstand all of these types of attack. 
\section[{d) Ease or complexity of configuration}]{d) Ease or complexity of configuration}\par
Unfortunately the usability of a system is usually inversely proportional to the flexibility and customizability of that system. The desire for flexibility can configurable of the system will be determined by the users of the system, the network in which it will be operating and the level of functionality required from the system. If the system is to be maintained by a network administrator who is also responsible for standard network management he or she is unlikely to have the time available to optimize and configure the system so usability will be a primary consideration. On the other hand if an intrusion analyst if employed specifically to manage intrusion detection a more complex system with greater functionality may be desired. 
\section[{e) Possible configuration options}]{e) Possible configuration options}\par
The NIDS should be capable of being optimized for the systems on the network. As mentioned earlier there is no point in performing http analysis if a web server is not operating on the network under inspection. The level of traffic on the network will also determine the intensity of analysis performed. A simple system suitable for a single network segment with low traffic will be able to combine the sensor and analysis functions within the single unit. A network with high levels of traffic may need to separate the sensor and analysis functions across different hosts. 
\section[{f) Scalability}]{f) Scalability}\par
Most organizations grow and expand over time. As they expand so do their supporting infrastructure, include computer networks. Any IDS should be capable of expanding with the network. As new network segments are added new NIDS may also be needed. Will it be possible to consolidate the reports from multiple NIDS into a single user interface? Another important question will be the storage of this information. If a small network is monitored data storage may be possible in flat files. However as the amount of data collected grows it may be necessary to transfer this data storage into a database. 
\section[{g) Interoperability}]{g) Interoperability}\par
Research has proven that the most effective intrusion detection requires correlating information from a range of sources. This includes NIDS, HIDS, system logs, firewall logs and any other information sources available. At the time of writing the Intrusion Detection Working Group (IDWG) had submitted a number of documents defining standards for communication between IDSs. It is expected that these will be released as RFCs in the near future. Once these standards are implemented any IDS using the standard protocols will be able to communicate with and other IDS. This will enable an organization to implement a range of IDS from different vendors and still maintain interoperability. 
\section[{h) Vendor Support}]{h) Vendor Support}\par
The level of vendor support required in a implementation will be determined by the skill levels of the staff implementing the system. However as staff turnover rates are common in the IT industry it is worthwhile considering the level of support that is available from the vendor. 
\section[{i) Signature Updates}]{i) Signature Updates}\par
Any signature based IDS is dependent upon it signatures to detect intrusions. The abilities of these systems to detect new, or even modified intrusions has been shown to be poor (Allen 2000). In order for these systems to be effective updated signatures must be available as new vulnerabilities and exploits are discovered. Many signature based systems now allow the operator to create their own signatures. This can allow the system to monitor for new alerts as they are discovered without relying on the vendor to supply updates. However monitoring vulnerabilities and writing signatures as they occur is a demanding task. 
\section[{V. CONCLUSION}]{V. CONCLUSION}\par
Selecting and implementing a NIDS is a challenging task. There are a number of factors to be considered, and these factors will change from situation to situation. In order to ensure a implementation an organization should determine its requirements and then locate a system that meets them. 			\footnote{© 2017 Global Journals Inc. (US)} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[ International Journal of Scientific Engineering Research]{b5}\label{b5} 	 		\textit{},  	 	 		\textit{International Journal of Scientific Engineering Research}  		p. .  	 
\bibitem[Kuang et al. ()]{b11}\label{b11} 	 		‘A novel hybrid KPCA and SVM with GA model for intrusion detection’.  		 			F Kuang 		,  		 			W Xu 		,  		 			S Zhang 		.  	 	 		\textit{Applied Soft Computing}  		2014. p. .  	 
\bibitem[Jyothsna et al. ()]{b1}\label{b1} 	 		‘A Review of Anomaly based Intrusion Detection Systems’.  		 			V Jyothsna 		,  		 			V V Rama Prasad 		,  		 			K Prasad 		.  	 	 		\textit{International Journal of Computer Applications}  		2011. p. .  	 
\bibitem[Wang and Stolfo ()]{b3}\label{b3} 	 		‘Anomalous Payloadbased Network Intrusion Detection’.  		 			Wang 		,  		 			S J Stolfo 		.  	 	 		\textit{7th Symposium on Recent Advances in Intrusion Detection},  				2004. Springer-Verlag. p. .  	 	 (USA: LNCS) 
\bibitem[Shirazi ()]{b2}\label{b2} 	 		‘Anomaly Intrusion Detection System using Information Theory, K-NN and KMC Algorithms’.  		 			H M Shirazi 		.  	 	 		\textit{Australian Journal of Basic and Applied Sciences}  		2009. p. .  	 
\bibitem[Anomaly-based intrusion detection system (2016)]{b6}\label{b6} 	 		\textit{Anomaly-based intrusion detection system},  		 \url{https://en.wikipedia.org/wiki/Anomalybased\textunderscore intrusion\textunderscore detection\textunderscore system}  		2016. July 16th. December 20th. 2016.  	 
\bibitem[Berkeley]{b8}\label{b8} 	 		\textit{CA 94704 USA: International Computer Science Institute},  		 			Berkeley 		.  		 	 
\bibitem[Mohammadpour and Hussain ()]{b10}\label{b10} 	 		‘Evaluating Performance of Intrusion Detection System using Support Vector Machines’.  		 			Leila Mohammadpour 		,  		 			Mehdi Hussain 		.  	 	 		\textit{Review. International Journal of Security and Its Applications}  		2015. p. .  	 	 (Alihossein Aryanfar, Vahid Maleki Raee and Fahad Sattar) 
\bibitem[Ranum ()]{b13}\label{b13} 	 		\textit{Experiences Benchmarking Intrusions Detection Systems},  		 			M J Ranum 		.  		2001. New York City, USA: NFR Security Technical Publications.  	 
\bibitem[Chebrolua et al. ()]{b0}\label{b0} 	 		\textit{Feature deduction and ensemble design of intrusion detection systems},  		 			Srilatha Chebrolua 		,  		 			Ajith Abrahama 		,  		 			Johnson P Thomasa 		.  		2005. ELSEVIER. p. .  	 
\bibitem[Icsa ()]{b15}\label{b15} 	 		 			Icsa 		.  		\textit{Intrusion Detection Systems. Japan: Information Technology Promotion Agency},  				2000.  	 
\bibitem[Wilkison (2002)]{b9}\label{b9} 	 		\textit{IDFAQ: How to Evaluate Network Intrusion Detection Systems? Retrieved from SANS Technology Institute},  		 			M Wilkison 		.  		 \url{https://www.sans.org/security-resources/idfaq/how-to-evaluate-network-intrusion-detection-systems/8/10}  		2002. June 10th.  	 
\bibitem[Shaker ()]{b4}\label{b4} 	 		‘Importance of Intrusion Detection System’.  		 			Asmaa Shaker 			\mbox{}\\  				IDS 			 		,  		 			Ashoor 			\mbox{}\\  				IDS 			 		.  	 	 		Prof. Sharad Gore.  		2005.  	 
\bibitem[Handley et al. ()]{b7}\label{b7} 	 		\textit{Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics},  		 			Mark Handley 		,  		 			Vern Paxson 		,  		 			Christian Kreibich 		.  		2001.  	 
\bibitem[The and Group (2001)]{b12}\label{b12} 	 		 			Nss The 		,  		 			Group 		.  		 \url{http://www.nss.co.uk}  		\textit{Intrusion Detection Systems Group Test},  				2001. March 23rd.  		 			NSS Group 		 	 
\bibitem[Alessandri ()]{b14}\label{b14} 	 		\textit{Using Rule-Based Activity Descriptions to Evaluate Intrusion Detection Systems},  		 			D Alessandri 		.  		 RAID 2001.  		2001.  	 
\end{bibitemlist}
 			 		 	 
\end{document}
