\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Performance Metrics Scorecard Based Approach to Intrusion Detection System Evaluation for Wireless Network},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2012-01-15 (revised: 15 January 2012)}
\def\TheID{\makeatother }
\def\TheDate{2012-01-15}
\title{A Performance Metrics Scorecard Based Approach to Intrusion Detection System Evaluation for Wireless Network}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Mr. Rupinder  Singh}

             \author[2]{Dr. Jatinder  Singh}

             \affil[1]{  Khalsa College, Amritsar, Punjab, India.}

\renewcommand\Authands{ and }

\date{\small \em Received: 11 December 2011 Accepted: 4 January 2012 Published: 15 January 2012}

\maketitle


\begin{abstract}
        


Wireless Intrusion Detection System (IDS) performance metrics are used to measure the ability of a wireless IDS to perform a particular task and to fit within the performance constraints. These metrics measure and evaluate the parameters that impact the performance of a wireless IDS.Wireless IDS analyze wireless specific traffic including scanning for external users trying to connect to the network through access points and play important role in security to the wireless network. Design of wireless IDS is a difficult task as wireless technology is advancing every day, performance metrics can play an important role in the design of efficient wireless IDS by measuring the factors concern with the performance of a wireless IDS. In this paper we provide a performance metrics scorecard based approach to evaluate intrusion detection systems that are currently popular for wireless networks in the commercial sector. We provide a set of performance metrics that are relevant to wireless IDS and use a "scorecard" containing the set of values as the centerpiece of testing and evaluating a wireless IDS. Evaluation of a wireless IDS is done by assigning score to various performance metrics concern with wireless IDS. We apply our performance metrics scorecard evaluation based approach to three popular wireless IDS Snort-wireless, AirDefense Guard, and Kismet. Finally we discuss the results and the opportunities for further work in this area.

\end{abstract}


\keywords{IDS, Performance metrics, Performance Constraints Access Points, Wireless, Metrics, Scorecard.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
ireless network is a novel technology involving the deployment of hundreds of low-cost, microhardware, and resource-limited sensor nodes. Wireless technologies are becoming increasingly ubiquitous in modern networks; however, this new technology comes with its own set of challenges. Wireless networks are inherently 'open' and viewable by all network scanners. There are no physical barriers between data sent through the air. As such, it is relatively easy to intercept data packets in a wireless network.\par
The biggest concern with wireless network is its security, for some time wireless has had very poor, if any, security on a wide-open medium. Wireless Intrusion Detection System (WIDS) is a new solution to help Author ? : Rupinder Singh, Department of Computer Science, Khalsa College, Amritsar, Punjab, India. E-mail : rupi\textunderscore singh76@yahoo.com Author ? : Dr. Jatinder Singh, Principal, Golden College of Engg. \& Tech., Gurdaspur, Punjab, India. E-mail : bal\textunderscore jatinder@rediffmail.com combat this problem. An Intrusion Detection System (IDS) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a management station  {\ref (Wikipedia, 2012)}. A wireless IDS performs this exclusively for the wireless network. This system monitors traffic on network looking for and logging threats and alerting personnel to respond.\par
Lord Kelvin said "If you cannot measure it, you cannot improve it". This fact also applies to wireless network security issues. An activity cannot be managed if it cannot be measured, this is a widely accepted management principle and security falls under this rubric. Metrics can be an effective tool for detecting the capability of a wireless IDS. Metrics can help in raising the level of security awareness within the network. Security metrics that are related to wireless network are hard to generate because the discipline itself is still in the early stages of development. There is not yet a common vocabulary and not many documented best practices to follow \hyperref[b4]{[4]}.\par
In this paper we provide a performance metrics scorecard based approach to evaluate intrusion detection systems that are currently popular for wireless network in the commercial sector. We describe a testing methodology we developed to evaluate Wireless IDS by assigning score to various performance metrics concern with wireless IDS. The approach followed in this paper do not compare wireless IDS against each other, but against a set of performance metrics concern with wireless IDS.\par
The generalized approach of this paper will allow systems with any wireless requirements to tailor evaluation of ID technologies to their specific needs. Since evaluation is against a static set of performance metrics the evaluation may be extended for other metrics like logistical metrics, architectural metrics, quality metrics etc. The standard approach of comparison used in this paper also gives us scientific repeatability. 
\section[{II.}]{II.} 
\section[{Snort, airdefense guard and kismet wireless ids}]{Snort, airdefense guard and kismet wireless ids}\par
In order to explain performance metrics scorecard based evaluation approach to wireless IDS, Snort works by implementing a detection engine that allows registering, warning, and responding to attacks previously defined. Snort is available under GPL (General Public License) and runs under Windows and GNU/Linux. It is among the most widely used, has a number of predefined signatures and continuously updated. Snort can be configured in three modes namely sniffer, packet logger, and network intrusion detection. In addition to all of these basic Snort features, Snort can be set up to send real-time alerts. This provides with the ability to receive alerts in real time, rather than having to continuously monitor Snort system. Snort is like a vacuum that takes packets and allows doing different things. Center piece of testing and evaluating wireless IDS will be a "scorecard" containing the set of performance metrics and their definitions. Each metric can have low (+), average (++), or high (+++) score, where higher scores will be interpreted as more favorable ratings.\par
The performance metrics used are general characteristics that are relevant to the design of wireless IDS. The method used for observing each performance metric value can be either analysis (source code analysis) or open source material (such as specifications, white papers or reviews provided by vendors or users). We use open source material to analyze each performance metrics for wireless IDS. We examine publicly available research papers, reports, product documentation, published conference material (proceedings) and other material available for public review. b) Performance Metrics for Wireless IDS Performance metrics are used to measure the ability of a Wireless IDS to perform a particular task and to fit within the performance constraints. These metrics measure and evaluate the parameters that impact the performance of the wireless IDS \hyperref[b12]{[15]}. The metrics defined in this area are shown in Table \hyperref[tab_1]{1}.\par
Table \hyperref[tab_1]{1}  In this section of the paper we will apply above mentioned approach to popular wireless IDS Snortwireless, AirDefense Guard, and Kismet. We choose these three for evaluation as they are most widely used and have different ways of working. Below with table  {\ref 2} we describe how scores to performance metrics related to these three wireless IDS are assigned.\par
Performance metric False Positive Ratio can be assigned score depending on the following criteria: The weighted average of False Positive and False Negative ratios.\par
Induced Traffic Latency It measures the delay in the arrival of packets at the target network in the presence and absence of a wireless IDS. 
\section[{Stress Handling and Point of Breakdown}]{Stress Handling and Point of Breakdown}\par
The point of breakdown is defined as the level of network or host traffic that results in a shutdown or malfunction of IDS. 
\section[{IDS Throughput}]{IDS Throughput}\par
This metric defines the level of traffic up to which the IDS performs without dropping any packet. 
\section[{Depth of System's Detection Capability}]{Depth of System's Detection Capability}\par
It is defined as the number of attack signature patterns and/or behavior models known to it. 
\section[{Reliability of Attack Detection}]{Reliability of Attack Detection}\par
It is defined as the ratio of false positives to total alarms raised. 
\section[{Possibility of Attack}]{Possibility of Attack}\par
It is defined as the ratio of false negatives to true negatives. 
\section[{Consistency}]{Consistency}\par
It is defined as the variations in the performance of a wireless IDS. 
\section[{Error Reporting and Recovery}]{Error Reporting and Recovery}\par
The ability of a wireless IDS to correctly report and recover. 
\section[{Firewall Interaction}]{Firewall Interaction}\par
The ability of a wireless IDS to interact with the Firewall systems. 
\section[{User Friendliness}]{User Friendliness}\par
The ability of a wireless IDS to configure according to user's environment. 
\section[{Router Interaction}]{Router Interaction}\par
Degree of interaction of a wireless IDS with the router. 
\section[{Compromise Analysis}]{Compromise Analysis}\par
It is the ability to report the extent of damage and compromise due to intrusions. 
\section[{Simple Network Management Protocol (SNMP) Interaction}]{Simple Network Management Protocol (SNMP) Interaction}\par
Ability of the wireless IDS to send an SNMP trap to one or more network devices in response to a detected attack. 
\section[{Timeliness}]{Timeliness}\par
Average/maximal time between an intrusion's occurrence and its being reported.\par
Table  {\ref 2} : Scorecard for Snort, AirDefense Guard and Kismet wireless IDS Snort-Wireless is the most advanced Open Source Wireless IDS. It uses the sequence number analysis technique to detect false frame attacks. In \hyperref[b14]{[19]} authors tested the effectiveness of the Snort-Wireless with the used data applying the purposed analysis technique. It is not capable of identifying the malicious packets as the threshold-based technique used by Snort-Wireless is prone to false negatives. Table  {\ref 3} provides the results produced by authors. AirDefense Guard wireless IDS produces very low false negative ratio as it has ability to detect 200+ attacks and policy violations. Kismet has less attack definitions and produces average false negative ratio.\par
Performance metric Cumulative False Alarm Rate can be assigned score depending on the following criteria: Inside the packet processing function, Snort performs several tasks. First, it calls into libpcap using the pcap\textunderscore dispatch function to process any waiting packets. For each packet that is available, libpcap calls the Pcap Process Packet function, which handles the actual packet processing. This function resets several per-packet counters, collects some statistics about the packet, and calls Process Packet. The Process Packet function handles all of the details of decoding the packet, printing the packet to the screen and either directly calling the packet logging functions or calling into the pre-processors. If no packets are available, Snort performs basic housekeeping chores such as checking for pending signals. In order to perform all this functions, Snort-Wireless IDS delays the arrival of packets at the target network. Air Defense has the most detailed available wireless forensic database in the industry. It has more than 300 wireless statistics per device per minute logged and has instant analysis using the forensic wizard \hyperref[b15]{[20]}. The point of breakdown is defined as the level of network or host traffic that results in a shutdown or malfunction of IDS. Air Defense. Kismet IDS identifies networks by collecting passively packets The detection engine is the time-critical part of Snort wireless. Depending upon how powerful user machine is and how many rules have been defined, it may take different amounts of time to respond to different packets. If traffic on the network is too high when Snort wireless is working in NIDS mode, it may drop some packets and may not get a true real-time response. The load on the detection engine of snort wireless depends upon the following factors:\par
? Number of rules ? Power of the machine on which Snort is running ? Speed of internal bus used in the Snort machine ? Load on the network Motorola Air Defense utilizes its 24x7, real-time monitoring of the 802.11a/b/g networks for most accurate intrusion detection of known as well as unknown attacks and does not easily breaks down. Kismet is able to handle stress up to some extent.\par
Performance metric IDS Throughput can be assigned score depending on the following criteria: ? Low Score (+): Wireless IDS regularly drops packets. ? Average Score (++): Wireless IDS rarely drops packets. ? High Score (+++): Wireless IDS can perform without dropping any packet.\par
When Snort wireless is working in Inline mode, it works like an Ethernet bridge, that is, in order to monitor a network segment, it has to be inserted transparently with two bridged NICs. With this setup, any packet can flow through the bridge from a network card to the other, unless it matches the drop rules; in that case, the switch opens and blocks the packet. So, Snort wireless drops packet only when it matches the drop rule specified by the user. Studies have shown that Air Defense rarely drops packets. Kismet processes data rate as supported by access point and drops more packets than others.\par
Performance metric Depth of System's Detection Capability can be assigned score depending on the following criteria: Snort wireless maintains a rule set in order to have the latest detection capabilities. Sourcefire Vulnerability Research Team (VRT) Rules are the official rules of snort wireless. One of the best features of Snort is its rule engine and language. Snort's rule engine provides an extensive language that enables user to write their own rules, allowing them to extend it to meet the needs of their own network. Motorola Air Defense wireless IDS utilizes 24x7, real-time monitoring of the 802.11a/b/g networks for producing most accurate intrusion detection of known and unknown attacks. It has ability to detect 200+ attacks and policy violations \hyperref[b15]{[20]}. Kismet has less number of attacks detections as compare to snort wireless and Air Defense guard.\par
Performance metric Reliability of Attack Detection can be assigned score depending on the following criteria: ? Low Score (+): Wireless IDS generates high ratio of false positives to total alarms raised.  frames. So, Wireless IDS snort generates high ratio of false negatives to true negatives. Air Defense guard has ability to detect 200+ attacks and policy violations and therefore produces less false positives and it generates low ratio of false negatives to true negatives. Kismet has average Possibility of Attack as it has average false negative ratio.\par
Performance metric Consistency can be assigned score depending on the following criteria: ? Low Score (+): Wireless IDS has high variations in the performance. ? Average Score (++): Wireless IDS has average variations inthe performance. ? High Score (+++): Wireless IDS has low or no variations in the performance.\par
In \hyperref[b15]{[20]} author evaluated two open source network based intrusion detection systems. Snort wireless performed well during tests, but did produce false positives and false negatives. Snort is very lightweight and fast but is limited in its ability to scale in bandwidth per instance. Studies show that Air Defense kismet has average variations in the performance. Performance metric Error Reporting and Recovery can be assigned score depending on the following criteria: ? Low Score (+): Wireless IDS has low or no ability to correctly report and recover.\par
? Average Score (++): Wireless IDS has average ability to correctly report and recover. ? High Score (+++): Wireless IDS has high ability to correctly report and recover.\par
Snort wireless generates reports that show what happened during the last day, week or month. -T option of snort wireless is very useful for testing and reporting on the Snort configuration. This option can be used to find any errors in the configuration files. Snort wireless provides tool that gives user a detailed report of actions taken during the update process. SPADE module keeps a record of history data and uses threshold values to report the anomalies. Air Defense guard has flexible alerting and reporting options with integration capabilities into the various Security Information Management (SIM) systems \hyperref[b15]{[20]}. Error Reporting and Recovery of kismet is poor as compare to snort wireless and Air Defense.\par
Performance metric Firewall Interaction can be assigned score depending on the following criteria: ? Low Score (+): Wireless IDS has poor interaction with the Firewall systems. ? Average Score (++): Wireless IDS has average interaction with the Firewall systems. ? High Score (+++): Wireless IDS has excellent interaction with the Firewall systems.\par
Snort Sam is a tool used to make Snort work with most commonly used firewalls. It is used to create a Firewall/IDS combined solution. Firewall can be configured to automatically block offending data and addresses from entering system when intruder activity is detected. It is available from http://www.snortsam.net/ where one can find the latest information. The tool consists of two parts: 1. A Snort output plug-in that is installed on the Snort sensor. 2. An agent that is installed on a machine close to Firewall or Firewall itself. Snort communicates to the agent using the output plug-in in a secure way. Air Defense Guard supports stateful Layer 2 and rolebased firewalls and base security policy on the user, group, location, encryption strength, etc. studies show that kismet also has good Firewall Interaction.\par
Performance metric User Friendliness can be assigned score depending on the following criteria: ? Low Score (+): It is difficult to configure wireless IDS according to user's environment.\par
? Average Score (++): Wireless IDS can be configured up to some extent according to user's environment. ? High Score (+++): Wireless IDS can be easily configured according to user's environment.\par
In snort wireless a thorough understanding of what snort. conf file is and how to configure it is essential to a successful deployment of Snort wireless as an IDS in user environment. Snort configuration consists of Global configuration (snort. conf), Optional *.rules file(s), and Additional files. Air Defense Guard is very user friendly as it provides location tracking of the devices on a map, and provides minute by minute granular forensic information for any of the device. Kismet only runs under LINUX and does not have easy to use graphical interface.\par
Performance metric Router Interaction can be assigned score depending on the following criteria: ? Low Score (+): Wireless IDS has a poor interaction with the router. ? Average Score (++): Wireless IDS has an average interaction with the router. ? High Score (+++): Wireless IDS has excellent interaction with the router.\par
Depending upon the type of router used, snort wireless can be used on a port. Some routers, like Cisco, allow to replicate all ports traffic on one port where snort machine can be attached. These ports are usually referred to as spanning ports. The best place to install Snort wireless is right behind the firewall or router so that all of the Internet traffic is visible to Snort before it enters any router or hub. Air Defense Guard provides nice router interaction. Kismet does not have good interaction with some of the routers like belking54g.\par
Performance metric Compromise Analysis can be assigned score depending on the following criteria:  In snort wireless snort SnmpPlugin is used to send snmp alerts to network management systems (NMS). The alerts can be traps or informs. This adds to significant power of the NMS by allowing it to monitor security of the network. It also allows snort wireless sensor to exploit the features that are built into the existing network management systems. Air Defense Guard eliminates many of vulnerabilities impacting the security of the wireless network by providing good interaction with SNMP. Kismet provides various utilities for configuring and monitoring of wireless Access Points under Linux using SNMP protocol.\par
Performance metric Timeliness can be assigned score depending on the following criteria: ? Low Score (+): Wireless IDS takes a lot of time to report the occurrence of an intrusion. ? Average Score (++): Wireless IDS takes average time to report the occurrence of an intrusion. ? High Score (+++): Wireless IDS takes a minimal time to report the occurrence of an intrusion.\par
Snort wireless is a packet-based system. The basic life of a packet inside snort starts with packet acquisition. Once the packet is inside snort it is passed into the packet decoder. After decoding, the packet is passed on to the pre-processors for normalization, statistical analysis, and some nonrule-based detection. Once the pre-processors are done with the packet it goes into the detection engine, where it is evaluated against all of the rules that were loaded from the configuration file. Finally, the packet is sent off into the output plug-ins for logging and alerting. So, it takes lot of time for snort wireless to detect an attack. Air Defense Guard takes average time for reporting of intrusion as it has 200+ attacks and policy violations detection capability. Studies show that kismet is slow in detection as compare to snort wireless and Air Defense.  
\section[{Conclusion and future work}]{Conclusion and future work}\par
Wireless IDS are used in detecting unwanted activities on a wireless network. Performance metrics can be used to measure the performance of a wireless IDS within the performance constraints. These metrics measure and evaluate the parameters that impact the performance of the wireless IDS. This paper provides a performance metrics scorecard based approach that can be used for evaluating a wireless IDS in order to find out how it behaves within performance constraints.\par
In this paper we provide various performance metrics concern with wireless IDS and a scorecard method for evaluation. Evaluation of a wireless IDS is done by assigning scores to various performance metrics. We use our evaluation methodology to test popular wireless IDS Snort, Air Defense Guard, and Kismet. We define commonly used performance metrics that are important to a wireless IDS, but a lot is required to be done to find out more ones like analysis of intruder intent, clarity of reports, effectiveness of generated filters, evidence collection, information sharing, user alerts, program interaction, session recording and playback, threat correlation, trend analysis, extendibility, adaptability, scalability, overhead, and latency. More performance metrics and their definitions can be defined as lessons are learned while evaluating a wireless network. Future work also includes applying the evaluation methodology to other metrics concern with wireless IDS like logistical metrics, architectural metrics, quality metrics etc.\begin{figure}[htbp]
\noindent\textbf{2012}\includegraphics[]{image-2.png}
\caption{\label{fig_0}W © 2012}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Table 3 :?}\end{figure}
  \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.85\textwidth}}
Year\\
2\\
Volume XII Issue XII Version I\\
D D D D )\\
(\\
Global Journal of Computer Science and Technology\end{longtable} \par
  {\small\itshape [Note: © 2012 Global Journals Inc. (US)]} 
\caption{\label{tab_1}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.46428571428571425\textwidth}P{0.3857142857142857\textwidth}}
Performance Metrics\tabcellsep Description\\
False Positive Ratio\tabcellsep \\
Cumulative False\tabcellsep \\
Alarm Rate\tabcellsep \\
\tabcellsep 3\\
\tabcellsep Volume XII Issue XII Version I\\
\tabcellsep D D D D ) E\\
\tabcellsep (\end{longtable} \par
  {\small\itshape [Note: signature, and anomaly-based inspection and produces low false positive ratio and gets a high score for this metric [8]. Air Defense guard has ability to detect 200+ attacks and policy violations and therefore produces less false positives. Kismet alert PROBENOJOIN can result excessive false positives while channel hopping is done. False positives are also possible in noisy/lossy situations, it is desirable to disable this alert in some installations [12]. Performance metric False Negative Ratio can be assigned score depending on the following criteria: ? Low Score (+): Wireless IDS generate high False Negative Ratio. ? Average Score (++): Wireless IDS generate average False Negative Ratio. ?]} 
\caption{\label{tab_2}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.017235023041474656\textwidth}P{0.7575576036866359\textwidth}P{0.024285714285714285\textwidth}P{0.028986175115207374\textwidth}P{0.02193548387096774\textwidth}}
\tabcellsep \multicolumn{4}{l}{and detecting standard named networks, detecting}\\
\tabcellsep \multicolumn{4}{l}{hidden networks, and inferring to the presence of}\\
\tabcellsep \multicolumn{4}{l}{Performance Metrics networks (non-beaconing) via data traffic. Snort wireless AirDefense Performance metric Stress Handling and Point Kismet Guard of Breakdown can be assigned score depending on the False Positive Ratio +++ +++ ++ following criteria:}\\
\tabcellsep \multicolumn{4}{l}{False Negative ? Low Score (+): Wireless IDS cannot handle stress}\\
\tabcellsep \multicolumn{2}{l}{Ratio and easily breakdowns. +}\tabcellsep ++\tabcellsep ++\\
2012 Year\tabcellsep \multicolumn{4}{l}{? Average Score (++): Wireless IDS can handle Cumulative False Alarm Rate ++ ++ ++ stress up to some extent before it breakdowns. ? High Score (+++): Wireless IDS can handle stress Induced Traffic Latency ++ +++ ++ Stress Handling at the maximum and can avoid breakdown.}\\
4\tabcellsep Breakdown and Point of\tabcellsep ++\tabcellsep +++\tabcellsep ++\\
\tabcellsep IDS Throughput\tabcellsep +++\tabcellsep +++\tabcellsep ++\\
\tabcellsep Depth of\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep System's\tabcellsep +++\tabcellsep +++\tabcellsep ++\\
\tabcellsep Detection\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep Capability\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep Reliability of\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep Attack Detection\tabcellsep ++\tabcellsep +++\tabcellsep ++\\
\tabcellsep Possibility of\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep Attack\tabcellsep +\tabcellsep ++\tabcellsep ++\\
\tabcellsep Consistency\tabcellsep ++\tabcellsep ++\tabcellsep ++\\
\tabcellsep Error Reporting\tabcellsep \tabcellsep \tabcellsep \\
D D D D ) E\tabcellsep and Recovery Firewall\tabcellsep +++\tabcellsep +++\tabcellsep ++\\
(\tabcellsep Interaction\tabcellsep +++\tabcellsep +++\tabcellsep +++\\
\tabcellsep User\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep Friendliness\tabcellsep ++\tabcellsep +++\tabcellsep +\\
\tabcellsep Router\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep Interaction\tabcellsep +++\tabcellsep +++\tabcellsep ++\\
\tabcellsep Compromise\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep Analysis\tabcellsep ++\tabcellsep ++\tabcellsep ++\\
\tabcellsep SNMP\tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep Interaction\tabcellsep +++\tabcellsep +++\tabcellsep ++\\
\tabcellsep Timeliness\tabcellsep ++\tabcellsep ++\tabcellsep ++\end{longtable} \par
 
\caption{\label{tab_3}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{}
\end{longtable} \par
 
\caption{\label{tab_6}?}\end{figure}
 			\footnote{© 2012 Global Journals Inc. (US)Global Journal of Computer Science and Technology} 			\footnote{© 2012 Global Journals Inc. (US)} 		 		\backmatter  			 			 			  				\begin{bibitemlist}{1}
\bibitem[ (2011)]{b1}\label{b1} 	 		\textit{},  		Jul.-Dec, 2011. 1.  	 
\bibitem[ (2012)]{b17}\label{b17} 	 		\textit{},  		June 2012. p. .  	 	 (Print) 
\bibitem[Freelance et al. (2009)]{b3}\label{b3} 	 		\textit{},  		 			Harrykar Freelance 		,  		 			" Harrykar's Techies Blog 		,  		 			Snort 		,  		 			Ids 		,  		 			. . . Ips 		,  		 			Beyond 		.  		May 2009. 31.  	 
\bibitem[Albin (2011)]{b4}\label{b4} 	 		\textit{A comparative analysis of the snort and suricata intrusion-detection systems},  		 			Eugene Albin 		.  		September 2011.  	 
\bibitem[Singh and Singh]{b16}\label{b16} 	 		‘A Logistic Metrics Scorecard Based Approach to Intrusion Detection System Evaluation for Wireless Network’.  		 			Rupinder Singh 		,  		 			Dr Jatinder Singh 		.  	 	 		\textit{International Journal of Computer Networks and Wireless Communications (IJCNWC)}  		2  (3) .  	 
\bibitem[Fink et al. (2002)]{b2}\label{b2} 	 		‘A Metrics -Based Approach to Intrusion Detection System Evaluation for Distributed Real-Time Systems’.  		 			G A Fink 		,  		 			B L Chappell 		,  		 			T G Turner 		,  		 			K F O'donoghue 		.  	 	 		\textit{WPDRTS}  		April 2002. p. .  	 
\bibitem[Singh and Singh]{b0}\label{b0} 	 		‘A Metrics Based Approach to Intrusion Detection System Evaluation for Wireless Network’.  		 			Rupinder Singh 		,  		 			Dr Jatinder Singh 		.  	 	 		\textit{International Journal of Education and Applied Research}  		 	 	 (IJEAR) 
\bibitem[David and Benjamin ()]{b10}\label{b10} 	 		‘A Performance Analysis of Snort and Suricata Network Intrusion Detection and Prevention Engines’.  		 			J David 		,  		 			M Benjamin 		.  	 	 		\textit{ICDS 2011 : The Fifth International Conference on Digital Society},  				2011. ISBN p. .  	 
\bibitem[Singaraju et al.]{b12}\label{b12} 	 		‘A Testbed for Quantitative Assesment of Intrusion Detection Systems Using Fuzzy Logic’.  		 			Gautam Singaraju 		,  		 			Lawrence Teo 		,  		 			Yuliang Zheng1 		.  		 IWIA'04) 0-7695- 2117-7/04.  	 	 		\textit{Proceedings of The Second IEEE International Information Assurance Workshop},  				 (The Second IEEE International Information Assurance Workshop)  		 	 
\bibitem[Singh and Singh (2012)]{b18}\label{b18} 	 		‘An Architectural Metrics Scorecard Based Approach to Intrusion BDetection System Evaluation for Wireless Network’.  		 			Rupinder Singh 		,  		 			Dr Jatinder Singh 		.  	 	 		\textit{Global Journal of Computer Science and Technology (GJCST)}  		June 2012. 12.  	 	 (Issue 11 Version 1.0) 
\bibitem[Mart´?nez_ et al.]{b14}\label{b14} 	 		\textit{Beacon Frame Spoofing Attack Detection in},  		 			Asier Mart´?nez\textunderscore  		,  		 			Urko Zurutuzayz 		,  		 			Roberto Uribeetxeberriay 		,  		 			Miguel Fern´andezy 		,  		 			Jesus Lizarragay 		,  		 			Ainhoa Sernay 		,  		 			I?naki V´elezy 		.  		 IEEE 802.11.  		 	 
\bibitem[Gómez et al. ()]{b6}\label{b6} 	 		‘Design of a Snort-Based Hybrid Intrusion Detection System’.  		 			J Gómez 		,  		 			C Gil 		,  		 			N Padilla1 		,  		 			R Baños 		,  		 			C Jiménez 		.  	 	 		\textit{IWANN 2009, Part II},  		LNCS  		 			S Omatu 		 (ed.)  		2009. 5518 p. .  	 
\bibitem[Rafeeq Ur Rehman]{b7}\label{b7} 	 		\textit{Intrusion Detection Systems with Snort Advanced IDS Techniques Using Snort, Apache, MySQL, PHP, and ACID},  		 			Rafeeq Ur Rehman 		.  		Prentice Hall.  	 
\bibitem[Savola (2010)]{b8}\label{b8} 	 		‘On The Feasibility of Utilizing Security Metrics in Software Intensive Systems’.  		 			Reijo Savola 		.  	 	 		\textit{IJCSNS International Journal of Computer Science and Network Security}  		January 2010. 10  (1) .  	 
\bibitem[PCI Wireless Compliance Demystified Best Practices for Retail]{b15}\label{b15} 	 		\textit{PCI Wireless Compliance Demystified Best Practices for Retail},  		 \url{http://www.airdefense.net/PCIpaper.Pdf}  		 	 
\bibitem[Fayssal]{b11}\label{b11} 	 		‘Performance analysis Toolset for wireless intrusion detection systems’.  		 			Samer Fayssal 		.  	 	 		\textit{2010 International Conference on High Performance Computing and Simulation (HPCS)},  				 (Caen, France, ISBN)  		p. .  	 
\bibitem[SNORT Users Manual 2.9.0, The Snort Project (2011)]{b5}\label{b5} 	 		\textit{SNORT Users Manual 2.9.0, The Snort Project},  		March 25, 2011.  	 
\bibitem[Boob and Jadhav (2010)]{b9}\label{b9} 	 		‘Wireless Intrusion Detection System’.  		 			Snehal Boob 		,  		 			Priyanka Jadhav 		.  	 	 		\textit{International Journal of Computer Applications}  		August 2010. 5  (8)  p. .  	 
\bibitem[Veseli]{b13}\label{b13} 	 		\textit{Wireless Intrusion Detection Systems},  		 			Fatbardh Veseli 		.  		 	 
\end{bibitemlist}
 			 		 	 
\end{document}
