Towards a taxonomy of intrusion-detection systems

Information security is an issue of serious global concern. The complexity, accessibility, and openness of the Internet have served to increase the security risk of information systems tremendously. This paper concerns intrusion detection. We describe approaches to intrusion detection using neural networks and support vector machines. The key ideas are to discover useful patterns or features that describe user behavior on a system, and use the set of relevant features to build classifiers that can recognize anomalies and known intrusions, hopefully in real time. Using a set of benchmark data from a KDD (knowledge discovery and data mining) competition designed by DARPA, we demonstrate that efficient and accurate classifiers can be built to detect intrusions. We compare the performance of neural networks based, and support vector machine based, systems for intrusion detection.

Intrusion detection using neural networks and support vector machines

Intrusion detection based upon computational intelligence is currently attracting considerable interest from the research community. Characteristics of computational intelligence (CI) systems, such as adaptation, fault tolerance, high computational speed and error resilience in the face of noisy information, fit the requirements of building a good intrusion detection model. Here we want to provide an overview of the research progress in applying CI methods to the problem of intrusion detection. The scope of this review will encompass core methods of CI, including artificial neural networks, fuzzy systems, evolutionary computation, artificial immune systems, swarm intelligence, and soft computing. The research contributions in each field are systematically summarized and compared, allowing us to clearly define existing research challenges, and to highlight promising new research directions. The findings of this review should provide useful insights into the current IDS literature and be a good source for anyone who is interested in the application of CI approaches to IDSs or related fields.

/pdf/review-the-use-of-computational-intelligence-in-intrusion-1r8rwmtm1h.pdf

Review: The use of computational intelligence in intrusion detection systems: A review

Machine Learning (ML) has been enjoying an unprecedented surge in applications that solve problems and enable automation in diverse domains. Primarily, this is due to the explosion in the availability of data, significant improvements in ML techniques, and advancement in computing capabilities. Undoubtedly, ML has been applied to various mundane and complex problems arising in network operation and management. There are various surveys on ML for specific areas in networking or for specific network technologies. This survey is original, since it jointly presents the application of diverse ML techniques in various key areas of networking across different network technologies. In this way, readers will benefit from a comprehensive discussion on the different learning paradigms and ML techniques applied to fundamental problems in networking, including traffic prediction, routing and classification, congestion control, resource and fault management, QoS and QoE management, and network security. Furthermore, this survey delineates the limitations, give insights, research challenges and future opportunities to advance ML in networking. Therefore, this is a timely contribution of the implications of ML for networking, that is pushing the barriers of autonomic network operation and management.

/pdf/a-comprehensive-survey-on-machine-learning-for-networking-3t5h3kbpe8.pdf

A comprehensive survey on machine learning for networking: evolution, applications and research opportunities

Misuse detection is the process of attempting to identify instances of network attacks by comparing current activity against the expected actions of an intruder Most current approaches to misuse detection involve the use of rule-based expert systems to identify indications of known attacks However, these techniques are less successful in identifying attacks which vary from expected patterns Artificial neural networks provide the potential to identify and classify network activity based on limited, incomplete, and nonlinear data sources We present an approach to the process of misuse detection that utilizes the analytical strengths of neural networks, and we provide the results from our preliminary analysis of this approach

/pdf/artificial-neural-networks-for-misuse-detection-56zhkhz0ty.pdf

Artificial Neural Networks for Misuse Detection

The timely and accurate detection of computer and network system intrusions has always been an elusive goal for system administrators and information security researchers. Existing intrusion detection approaches require either manual coding of new attacks in expert systems or the complete retraining of a neural network to improve analysis or learn new attacks. This paper presents a new approach to applying adaptive neural networks to intrusion detection that is capable of autonomously learning new attacks rapidly through the use of a modified reinforcement learning method that uses feedback from the protected system. The approach has been demonstrated to be extremely effective in learning new attacks, detecting previously learned attacks in a network data stream, and in autonomously improving its analysis over time using feedback from the protected system.

D James

Papers

Next Generation Intrusion Detection: Autonomous Reinforcement Learning of Network Attacks

A Comparative Analysis of Current Intrusion Detection Technologies

New Methods of Intrusion Detection Using Control-Loop Measurement

An Adaptive Neural Network Approach to Intrusion Detection and Response

Artificial Neural Networks to Misuse Detection