\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={An Architectural Metrics Scorecard Based Approach to Intrusion Detection System Evaluation for Wireless Network},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2012-01-15 (revised: 15 January 2012)}
\def\TheID{\makeatother }
\def\TheDate{2012-01-15}
\title{An Architectural Metrics Scorecard Based Approach to Intrusion Detection System Evaluation for Wireless Network}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Mr. Rupinder  Singh}

             \author[2]{Dr. Jatinder  Singh}

             \affil[1]{  Khalsa College, Amritsar, Punjab, India.}

\renewcommand\Authands{ and }

\date{\small \em Received: 15 December 2011 Accepted: 3 January 2012 Published: 15 January 2012}

\maketitle


\begin{abstract}
        


Wireless IDS architectural metrics are used to compare the intended scope, architecture of wireless IDS, and how they match the deployment architecture. These metrics can be used to evaluate the architectural efficiency of a wireless IDS and can help in designing efficient wireless IDS.Wireless IDS analyze wireless specific traffic including scanning for external users trying to connect to the network through access points and play important role in security to wireless network. Design of wireless IDS is a difficult task as wireless technology is advancing every day, Architectural metrics can play an important role in the design of wireless IDS by measuring the areas concern with the architecture of a wireless IDS. In this paper we describe a set of architectural metrics that are relevant to wireless IDS. A "scorecard" containing the set of values is used as the centerpiece of testing and evaluating a wireless IDS. Evaluation of a wireless IDS can be done by assigning score to various architectural metrics concern with wireless IDS. We apply our architectural metrics scorecard based evaluation approach to three popular wireless IDS Snort-wireless, AirDefense Guard, and Kismet. Finally we discuss the results and the opportunities for further work in this area.

\end{abstract}


\keywords{Architectural Metrics, Wireless, Metrics, IDS, and Scorecard.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
new and exciting world has been opened by wireless. Its technology is advancing every day and its popularity is increasing. The biggest concern with wireless, however, has been its security, for some time wireless has had very poor, if any, security on a wide-open medium. Along with improved encryption schemes, a new solution to help combat this problem is the Wireless Intrusion Detection System (WIDS). An Intrusion Detection System (IDS) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station  {\ref (Wikipedia, 2012)}. A wireless IDS performs this exclusively for the wireless network. This system monitors traffic on network looking for threats and alerting personnel to respond.\par
Lord Kelvin said "If you cannot measure it, you cannot improve it". This fact also applies to wireless network security issues. An activity cannot be managed if it cannot be measured, this is a widely accepted management principle and security falls under this rubric. Metrics can be an effective tool for security providers to discern the effectiveness of various components of their security programs. Metrics can play an important role in the designing of wireless IDS. Security Metrics that are related to wireless network are hard to generate because the discipline itself is still in the early stages of development. There is not yet a common vocabulary and not many documented best practices to follow \hyperref[b0]{[1]}.\par
This paper provides an architectural metrics scorecard based approach to evaluate Intrusion Detection Systems that are currently popular for wireless in the commercial sector. We describe a testing methodology we developed to evaluate wireless IDS by assigning score to various architectural metrics concern with it. The approach followed in this paper do not compare wireless IDS against each other, but against a set of architectural metrics concern with wireless IDS.\par
The generalized approach of this paper will allow systems with any wireless requirements to tailor evaluation of ID technologies to their specific needs. Since evaluation is against a static set of architectural metrics the evaluation may be extended for other metrics like logistical metrics, performance metrics, quality metrics etc. The standard approach of comparison used in this paper also gives us scientific repeatability. 
\section[{II. Snort, Airdefense Guard and Kismet Wireless Ids}]{II. Snort, Airdefense Guard and Kismet Wireless Ids}\par
In order to explain architectural metrics scorecard based evaluation approach to wireless IDS, we choose three wireless IDS namely Snort-wireless, AirDefense Guard, and Kismet as these are one of the most popular and works on different technology. 
\section[{a) Snort Wireless IDS}]{a) Snort Wireless IDS}\par
Snort is an open source network intrusion detection and prevention system (IDS/IPS) that combines the benefits of signature, protocol, and anomaly-based inspection, and is the most widely1 2012 ( D D D D )\par
deployed IDS/IPS technology worldwide. With millions of downloads Snort has become the de facto standard for IDS/IPS \hyperref[b2]{[4]}. Snort-wireless allows for custom rules to be created based on framing information from a wireless packet. It also contains rules to attempt to find rogue access points, war drivers, and ad hoc networks.\par
Snort-wireless works by implementing a detection engine that allows registering, warning, and responding to attacks previously defined. Snort-wireless is available under GPL (General Public License) and runs under Windows and GNU/Linux. It is among the most widely used, has a number of predefined signatures and continuously updated. Snort wireless can be configured in three modes namely sniffer, packet logger, and network intrusion detection. In addition to all of these basic Snort-wireless features, Snort-wireless can be set up to send real-time alerts. This provides with the ability to receive alerts in real time, rather than having to continuously monitor Snort system. Snort is like a vacuum that takes packets and allows to do different things. 
\section[{b) AirDefense Guard Wireless IDS}]{b) AirDefense Guard Wireless IDS}\par
AirDefense Guard is a wireless IDS that provides advanced intrusion detection for wireless LANs based on signature analysis, policy deviation, protocol assessment policy deviation and statistically anomalous behavior. AirDefense Guard is able to respond to attacks with Active Defense technology, which interfaces with the access points to disconnect the attackers connection to the WLAN.\par
AirDefense can be used to identity theft. This is done by stealing an authorized MAC address, an intruder has full access to the network. However, AirDefense tracks the digital fingerprints vendor-specific characteristics and personal trademarks of authorized users to identify intruders in the network. AirDefense can be used to detect Denial-of-Service (DoS) attacks. AirDefense is able to quickly recognize the early signs and protocol abuses of a DoS attack that jams the airwaves and shuts down a wireless LAN. AirDefense can also be used to detect Man-in-the-Middle attacks. Posing as an access point, intruders can force workstations to disassociate from authorized access points and route all traffic through the intruder. The intruder can then gain access to the network by posing as an authorized user and simultaneously operating on multiple channels. AirDefense detects man-in-themiddle attacks and ensure that access points only operate on set channels and proper protocols are used. c) Kismet Wireless IDS Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will works with any wireless card that supports raw monitoring mode, and can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet also supports plugins that allows sniffing other media such as DECT.\par
Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting hidden networks, and inferring the presence of nonbeaconing networks via data traffic  {\ref [8]}. Kismet wireless IDS without sending any loggable packets is able to detect the presence of both wireless access points and wireless clients, and associate them with each other. Unlike most other wireless network detectors. Kismet has the ability to log all sniffed packets and save them in a tcpdump /Wireshark or Airsnortcompatible fileformat. Kismet also captures PPI headers. Kismet also has the ability to detect default or "not configured" networks, probe requests, and determine what levels of wireless encryptions is used on a given access point. Kismet also supports logging of the geographical coordinates of the network if the input from a GPS receiver is additionally available  {\ref [12]}. 
\section[{III.}]{III.} 
\section[{Architectural Metrics Scorecard}]{Architectural Metrics Scorecard}\par
Based Approach a) Developing Scorecard\par
Centerpiece of testing and evaluating wireless IDS will be a "scorecard" containing the set of architectural metrics and their definitions. Each metric can have low (+), average (++), or high (+++) score, where higher scores will be interpreted as more favorable ratings.\par
The architectural metrics used are general characteristics that are relevant to architecture of a wireless IDS. The method used for observing each architectural metric value can be either analysis (source code analysis) or open source material (such as specifications, white papers or reviews provided by vendors or users). We use open source material to analyze each architectural metrics for wireless IDS. We examine publicly available research papers, reports, product documentation, published conference material (proceedings) and other material available for public review. b) Architectural Metrics for a Wireless IDS Architectural metrics are used to compare the intended scope and architecture of wireless IDS and how they match the deployment architecture. These metrics evaluate the architectural efficiency of a Wireless IDS \hyperref[b9]{[13]}. The metrics defined in this area are shown in The difficulty of altering the sensitivity of a wireless IDS in order to achieve a balance between false positive and false negative error rates at various times and for different environments. 
\section[{Required Data Storage Capacity}]{Required Data Storage Capacity}\par
The amount of disk space needed to store logs and other application data. 
\section[{Load Balancing Scalability}]{Load Balancing Scalability}\par
It measures the ability of a wireless IDS to partition traffic into independent, balanced sensor loads. 
\section[{Multiple Sensor Support}]{Multiple Sensor Support}\par
The cardinality of sensors supported. 
\section[{Reordering and Stream Reassembly}]{Reordering and Stream Reassembly}\par
It can be used to find an attack that has been artificially fragmented and transmitted out of order. 
\section[{State Tracking}]{State Tracking}\par
This metric is useful in hardening wireless IDS against storms of random traffic used to confuse it. 
\section[{Data Pool Selectability}]{Data Pool Selectability}\par
This metric is used to define the data source to be analyzed for intrusions. 
\section[{System Throughput}]{System Throughput}\par
Maximal data input rate that can be processed successfully by the wireless IDS. In this section we will apply above mentioned approach to popular wireless IDS Snort-wireless, AirDefense Guard, and Kismet. We choose these three for evaluation as they are one of the most widely used and have different ways of working. Below with table 2 we describe how scores to architectural metrics related to these three wireless IDS are assigned. 
\section[{Architectural Metrics}]{Architectural Metrics} 
\section[{Snort wireless}]{Snort wireless}
\begin{quote}
AirDefense\end{quote}
\par
Architectural metric Adjustable Sensitivity can be assigned score depending on the following criteria: Low Score (+): No Adjustability. Average Score (++): Adjustability via static methods. High Score (+++): Intelligent, dynamic Adjustability.\par
Snort-wireless makes use of the SSL Dynamic Preprocessor (SSLPP), which decodes SSL and TLS traffic and optionally determines if and when Snortwireless should stop inspection of it. Encrypted traffic is ignored by Snort-wireless for both performance reasons and to reduce false positive and false negative error rate  {\ref [15]}. So, Snort-wireless gets a high score (+++) for metric adjustable sensitivity. Kismet wireless provides alerts based on fingerprints (specific nets tumbler versions). In an attempt to disclose the SSID of a network, Nets tumbler sends out unique packets. This is not done in all situations, but when it is detected the potential for false positives is very low  {\ref [16]}. So, kismet gets average score for metric adjustable sensitivity. As described in [17] Air defense guard delivered a false positive for a Nets tumbler scan that turned out to be one of test laptops pinging an AP. Air Defense acknowledged that its Nets tumbler, signature needs some tweaking. So, it gets average score for metric adjustable sensitivity.\par
Architectural metric Required Data Storage Capacity can be assigned score depending on the following criteria:\par
Low Score (+): Large capacity storage needed to store log and other files.\par
Average Score (++): Medium capacity storage needed to store log and other files.\par
High Score (+++): Low capacity storage needed to store log and other files. Databases are used with Snort wireless to store log and alert data. Logging data to files in the disk is fine for smaller applications. However, keeping log data in disk files is not appropriate when there are multiple Snort-wireless sensors or there is need to keep historical data as well. Databases also allow to analyze data generated by Snort-wireless sensors. Snort-wireless uses rules stored in text files that can be modified by a text editor. Rules are grouped in categories. Rules belonging to each category are stored in separate files. These files are then included in a main configuration file called snort.conf. Alerts are also stored in log files or databases where they can be viewed later on by security experts. Snort wireless needs a large database as its rules grows and gets a for this metric. Airdefense guard makes use of average data storage. Kismet wireless makes use of predefine rules and therefore needs less storage to store files.\par
Architectural metric Load Balancing Scalability can be assigned score depending on the following criteria: Low Score (+): No load balancing scalability. Average Score (++): Low load balancing scalability. database is not strictly "real-time". There is a certain delay which depends upon frequency of uploading data using SCP to the centralized database server. This arrangement is shown in Figure  {\ref 1 [7]}.\par
Figure  {\ref 1} : Distributed Snort-wireless installation with the help of tools like SCP and Barnyard \hyperref[b5]{[7]} Collaborative Intelligence Architecture (DCIA), pioneered by Air Defense, to provide the most comprehensive wireless intrusion protection. DCIA uses a dedicated network of sensors and embedded client based agents that continuously monitor the airwaves and wireless activity for attacks and policy violations. In addition, the sensors use an intelligent channel scanning algorithm to detect traffic across the RF spectrum. So, Air Defense guard also gets a +++ score. Like Snort-wireless and Air defense Kismet wireless also have a support to multiple sensors.\par
Architectural metric Reordering and Stream Reassembly can be assigned score depending on the following criteria:\par
Low Score (+): No capability to find an attack that has been artificially fragmented and transmitted out of order.\par
Average Score (++): Very less capability to find an attack that has been artificially fragmented and transmitted out of order.\par
High Score (+++): Highly capable to find an attack that has been artificially fragmented and transmitted out of order.\par
The open source IDS Snort wireless implement target-based analysis with the frag3 preprocessor. Frag3 is able to reassemble overlapping fragments using the same policy as the destination host. A user configures the IDS to apply specific fragmentation reassembly policies for individual hosts or networks. Then, when the Snort sees overlapping fragments bound for any of these hosts, it knows the appropriate reassembly policy to apply-allowing both Snort and the destination host to reassemble the fragments identically. If the bandwidth being passed by the network interface associated with a Snort-wireless instance is greater than it can handle, more instances of Snortwireless can be launched and the traffic can be load balanced across the instances. An Adaptive load balancing architecture for snort is discussed in \hyperref[b11]{[18]}. So, snort wireless gets a +++ score for this metric.\par
Motorola AirDefene guard wireless IDS clients use a sophisticated load-balancing algorithm when too many clients attempt to connect to a particular access point. The clients use a beacon element to perform preemptive roaming and load balancing, thereby moving from a heavily loaded AP to one that is less loaded. Kismet wireless is not as capable as Snortwireless and AirDefense Gurad for load balancing scalability.\par
Architectural metric Multiple Sensor Support can be assigned score depending on the following criteria:\par
Low Score (+): Very less number of sensors supported.\par
Average Score (++): Average number of sensors supported.\par
High Score (+++): Large number of sensors supported.\par
A corporate environment probably have multiple locations and there is need to install Snort-wireless sensors. There are multiple ways to setup and install Snort-wireless in the enterprise as a distributed IDS. One method is to connect multiple sensors to the same centralized database. All data generated by these sensors is stored in the database. A user then uses a web browser to view this data and analyze it.\par
In an alternate mechanisms, Snort-wireless sensors do not have a direct connection to the database server. The sensors may be configured to log to local files. These files can then be uploaded to a centralized server on a periodic basis using utilities like SCP. The only problem with this approach is that the data in the Snort wireless gets a +++ score for this metric. The Air Defense solution is based on a Distributed Snort wireless gets a +++ score as it is able to find an attack that has been artificially fragmented and transmitted out of order. AirDefense Guard and Kismet wireless are also capable for out of order attaks.\par
Architectural metric State Tracking can be assigned score depending on the following criteria:\par
Low Score (+): No capability to detect storms of random traffic used to confuse wireless IDS.\par
Average Score (++): Less capability to detect storms of random traffic used to confuse wireless IDS.\par
High Score (+++): High capability to detect storms of random traffic used to confuse wireless IDS.\par
Snort wireless gets a high score for metric state tracking as Snort wireless provides many configuration and command line options to detect storms of random traffic that can be specified in the snort configuration file. Table \hyperref[tab_4]{3} describes such commands. AirDefense guard and Kismet wireless are also able to track state and gets a +++ score.\par
Architectural metric Data Pool Selectability can be assigned score depending on the following criteria:\par
Low Score (+): Poor capability to detect the data source to be analyzed for intrusion.\par
Average Score (++): Average capability to detect the data source to be analyzed for intrusion.\par
High Score (+++): Highly capable to detect the data source to be analyzed for intrusion Snort wireless gets a +++ score for metric data pool selectablity as Snort is a very complex pattern matcher geared toward detecting patterns of network attack traffic. On any If Snort has to work with a high speed connection, then there is need to use unified logging and a unified log reader such as barnyard. This allows Snort-wireless to log alerts in a binary form as fast as possible while another program performs the slow actions, such as writing to a database. AirDefense Guard and Kismet wireless process less data input rate as compare to snort wireless and both gets ++ score for the metric system throughput. Figure \hyperref[fig_2]{2} shows score of Snort-wireless, Airdefense and Kismet IDS.\par
IV. 
\section[{Conclusion and Future Work}]{Conclusion and Future Work}\par
Unwanted activities on a wireless network can be detected by a wireless IDS. Architectural design of a wireless IDS is a difficult task as the technology of design of wireless network is changing at a pace which brings additional challenges in the design of wireless IDS. This paper provides an architectural metrics scorecard based approach that can be used for evaluating a wireless IDS in order to find out the areas in which wireless IDS is weak and needs improvement. Depending upon the requirements of the system these metrics me given priorities and appropriate wireless IDS may be selected after developing the scorecard.\par
In this paper we define various architectural metrics concern with wireless IDS and a scorecard method to evaluate a wireless IDS by assigning scores to various architectural metrics. We use our evaluation methodology to test popular wireless IDS Snort-wireless, Air Defense Guard, and Kismet. This paper defines commonly used architectural metrics that are important to a wireless IDS, but a lot is required to be done to find out more ones like anomaly based, autonomous learning, Host/OS security, interoperability, package contents, process security, signature based, visibility etc. More architectural metrics and their definitions can be defined as lessons are learned while evaluating a wireless network. Future work also includes applying the evaluation methodology to other metrics concern with wireless IDS like logistical metrics, performance metrics, quality metrics etc.  
\section[{Enable\textunderscore decode\textunderscore  drops}]{Enable\textunderscore decode\textunderscore  drops}\par
Enables the dropping of bad packets identified by decoder (only applicable in inline mode). 
\section[{Enable\textunderscore tcpopt\textunderscore e xperimental\textunderscore dro ps}]{Enable\textunderscore tcpopt\textunderscore e xperimental\textunderscore dro ps}\par
Enables the dropping of bad packets with experimental TCP option. (only applicable in inline mode). 
\section[{Enable\textunderscore tcpopt\textunderscore o bsolete\textunderscore  Drops}]{Enable\textunderscore tcpopt\textunderscore o bsolete\textunderscore  Drops}\par
Enables the dropping of bad packets with obsolete TCP option. (only applicable in inline mode). 
\section[{Enable\textunderscore tcpopt\textunderscore tt cp\textunderscore drops}]{Enable\textunderscore tcpopt\textunderscore tt cp\textunderscore drops}\par
Enables the dropping of bad packets with T/TCP option. (only applicable in inline mode). 
\section[{Enable\textunderscore tcpopt\textunderscore d rops}]{Enable\textunderscore tcpopt\textunderscore d rops}\par
Enables the dropping of bad packets with bad/truncated TCP option (only applicable in inline mode). 
\section[{Enable\textunderscore ipopt\textunderscore dr ops}]{Enable\textunderscore ipopt\textunderscore dr ops}\par
Enables the dropping of bad packets with bad/truncated IP options (only applicable in inline mode).  \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{fig_0}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-3.png}
\caption{\label{fig_2}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.85\textwidth}}
. Other Architectural metrics that may be\\
included are: Anomaly Based, Autonomous Learning,\\
Host/OS Security, Interoperability, Package Contents,\\
Process Security, Signature Based, and Visibility [6].\end{longtable} \par
  {\small\itshape [Note: E]} 
\caption{\label{tab_0}Table 1}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{}
\end{longtable} \par
 
\caption{\label{tab_1}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.85\textwidth}}
3\\
Volume XII Issue XI Version I\\
D D D D ) E\\
(\\
Global Journal of Computer Science and Technology\end{longtable} \par
  {\small\itshape [Note: © 2012 Global Journals Inc. (US)]} 
\caption{\label{tab_2}Table 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3} \par 
\begin{longtable}{P{0.85\textwidth}}
Architectural metric System Throughput can be\\
assigned score depending on the following criteria:\\
Low Score (+): Wireless IDS can successfully\\
process less data input rate.\\
Average Score (++): Wireless IDS can\\
successfully process average data input rate.\\
High Score (+++): Wireless IDS can\\
successfully process high data input rate.\end{longtable} \par
 
\caption{\label{tab_4}Table 3 :}\end{figure}
 			\footnote{© 2012 Global Journals Inc. (US)Global Journal of Computer Science and Technology} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[Freelance et al. (May 09)]{b4}\label{b4} 	 		\textit{},  		 			Harrykar Freelance 		,  		 			" Harrykar's Techies Blog 		,  		 			Snort 		,  		 			Ids 		,  		 			Nsm Ips 		.  		May 09. p. 31.  	 
\bibitem[Enterprise Wlan Design Guide (2008)]{b1}\label{b1} 	 		\textit{},  		 			Motorola Enterprise Wlan Design Guide 		.  		 \url{http://www.scantexas.com/asset/support/Motorola\%20Enterprise\%20WLN\%20Design\%20Guide.pdf}  		November 2008.  	 
\bibitem[Fink et al. (2002)]{b3}\label{b3} 	 		‘A Metrics -Based Approach to Intrusion Detection System Evaluation for Distributed Real -Time Systems’.  		 			G A Fink 		,  		 			B L Chappell 		,  		 			T G Turner 		,  		 			K F O'donoghue 		.  	 	 		\textit{WPDRTS}  		April 2002.  	 
\bibitem[Singh and Singh (2011)]{b0}\label{b0} 	 		‘A Metrics-Based Approach to Intrusion Detection System Evaluation for Wireless Network’.  		 			Rupinder Singh 		,  		 			Dr Jatinder Singh 		.  	 	 		\textit{International Journal of Education and Applied Research (IJEAR)}  		 2249-4944.  		Jul.-Dec., 2011. 1  (1) .  	 
\bibitem[Alam et al.]{b11}\label{b11} 	 		\textit{Adaptive load balancing architecture for snort},  		 			M Alam 		,  		 			Qasim Javed 		,  		 			M Akbar 		.  		 \url{http://www.geocities.ws/raza\textunderscore nust/incc.pdf}  		 	 
\bibitem[Gómez et al. ()]{b7}\label{b7} 	 		‘Design of a Snor -Based Hybrid Intrusion Detection System’.  		 			J Gómez 		,  		 			C Gil 		,  		 			N Padilla1 		,  		 			R Baños 		,  		 			C Jiménez 		.  	 	 		\textit{Part II},  				2009. 2009. 5518.  	 
\bibitem[Rafeeq Ur Rehman ; Apache and Mysql]{b5}\label{b5} 	 		\textit{Intrusion Detection System with Snort Advanced IDS Techniques Using Snort},  		 			Rafeeq Ur Rehman ; Apache 		,  		 			Php Mysql 		,  		 			Acid 		.  		 \url{http://ptgmedia.pearsoncmg.com/images/013147333/downloads/0131407333.pdf}  		Prentice Hall. p. .  	 
\bibitem[Savola (2010)]{b8}\label{b8} 	 		‘On the Feasibility of Utilizing Security Metrics in Software Intensive Systems’.  		 			Reijo Savola 		.  	 	 		\textit{IJCSNS}  		January 2010. 10  (1) .  	 
\bibitem[Northcutt]{b2}\label{b2} 	 		\textit{Snort 2.1 Intrusion Detection},  		 			Stephen Northcutt 		.  		Shroff Publishers. ISBN p. .  	 	 (Second Edition) 
\bibitem[SNORT Users Manual 2.9.0, Snort Project (2011)]{b6}\label{b6} 	 		\textit{SNORT Users Manual 2.9.0, Snort Project},  		March 2011.  	 
\bibitem[SNORT Users Manual 2.9.1, the Snort Project (2011)]{b10}\label{b10} 	 		\textit{SNORT Users Manual 2.9.1, the Snort Project},  		 \url{http://www.networkcomputing.com/wireless/22962263?printer\textunderscore friendly=this-page}  		September 20. 2011.  	 
\bibitem[Boob and Jadhav (2010)]{b9}\label{b9} 	 		‘Wireless Intrusion Detection System’.  		 			Snehal Boob 		,  		 			Priyanka Jadhav 		.  	 	 		\textit{International Journal of Computer Applications}  		August 2010. 5  (8)  p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
