TY - JOUR
T1 - A Hybrid Artificial Immune System and Self Organising Map for Network Intrusion Detection
AU - Powers, Simon
AU - He, Jun
N1 - Powers, S., He, J. (2008). A Hybrid Artificial Immune System and Self Organising Map for Network Intrusion Detection. Information Sciences, 178 (15), 3024-3042
PY - 2008/8/1
Y1 - 2008/8/1
N2 - Network intrusion detection is the problem of detecting unauthorised use of, or access to, computer systems over a network. Two broad approaches exist to tackle this problem: anomaly detection and misuse detection. An anomaly detection system is trained only on examples of normal connections, and thus has the potential to detect novel attacks. However, many anomaly detection systems simply report the anomalous activity, rather than analysing it further in order to report higher-level information that is of more use to a security officer. On the other hand, misuse detection systems recognise known attack patterns, thereby allowing them to provide more detailed information about an intrusion. However, such systems cannot detect novel attacks.
A hybrid system is presented in this paper with the aim of combining the advantages of both approaches. Specifically, anomalous network connections are initially detected using an artificial immune system. Connections that are flagged as anomalous are then categorised using a Kohonen Self Organising Map, allowing higher-level information, in the form of cluster membership, to be extracted. Experimental results on the KDD 1999 Cup dataset show a low false positive rate and a detection and classification rate for Denial-of-Service and User-to-Root attacks that is higher than those in a sample of other works.
AB - Network intrusion detection is the problem of detecting unauthorised use of, or access to, computer systems over a network. Two broad approaches exist to tackle this problem: anomaly detection and misuse detection. An anomaly detection system is trained only on examples of normal connections, and thus has the potential to detect novel attacks. However, many anomaly detection systems simply report the anomalous activity, rather than analysing it further in order to report higher-level information that is of more use to a security officer. On the other hand, misuse detection systems recognise known attack patterns, thereby allowing them to provide more detailed information about an intrusion. However, such systems cannot detect novel attacks.
A hybrid system is presented in this paper with the aim of combining the advantages of both approaches. Specifically, anomalous network connections are initially detected using an artificial immune system. Connections that are flagged as anomalous are then categorised using a Kohonen Self Organising Map, allowing higher-level information, in the form of cluster membership, to be extracted. Experimental results on the KDD 1999 Cup dataset show a low false positive rate and a detection and classification rate for Denial-of-Service and User-to-Root attacks that is higher than those in a sample of other works.
KW - Artificial immune system
KW - Self Organizing Map
KW - Intrusion detection
KW - Genetic algorithm
KW - Negative selection
KW - Anomaly detection
U2 - 10.1016/j.ins.2007.11.028
DO - 10.1016/j.ins.2007.11.028
M3 - Article
SN - 0020-0255
VL - 178
SP - 3024
EP - 3042
JO - Information Sciences
JF - Information Sciences
IS - 15
ER -