Intrusion Detection at Packet Level by Unsupervised Architectures
Fecha de publicación
Springer Science + Business Media
Intelligent Data Engineering and Automated Learning - IDEAL 2007. Lecture Notes in Computer Science. Volumen 4881, pp. 718-727.
Intrusion Detection Systems (IDS’s) monitor the traffic in computer networks for detecting suspect activities. Connectionist techniques can support the development of IDS’s by modeling ‘normal’ traffic. This paper presents the application of some unsupervised neural methods to a packet dataset for the first time. This work considers three unsupervised neural methods, namely, Vector Quantization (VQ), Self-Organizing Maps (SOM) and Auto-Associative Back-Propagation (AABP) networks. The former paradigm proves quite powerful in supporting the basic space-spanning mechanism to sift normal traffic from anomalous traffic. The SOM attains quite acceptable results in dealing with some anomalies while it fails in dealing with some others. The AABP model effectively drives a nonlinear compression paradigm and eventually yields a compact visualization of the network traffic progression.
978-3-540-77225-5 (Print) / 978-3-540-77226-2 (Online)
- BISITE. Congresos