Summary
Conventional knowledge acquisition methods such as semantic knowledge, production rules and question answering systems have been addressed to a variety of typical knowledge based systems. However, very limited causal knowledge based methods have been addressed to the problem of intrusion detection. In this paper, we propose an approach based on causal knowledge reasoning for anomaly intrusion detection. Fuzzy cognitive maps (FCM) are ideal causal knowledge acquiring tool with fuzzy signed graphs which can be presented as an associative single layer neural network. Using FCM, our methodology attempt to diagnose and direct network traffic data based on its relevance to attack or normal connections. By quantifying the causal inference process we can determine the attack detection and the severity of odd packets. As such packets with low causal relations to attacks can be dropped or ignored and/or packets with high causal relations to attacks are to be highlighted.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Aguilar, J.: A dynamic fuzzy-cognitive-map approach based on random neural networks. International Journal of Computational Cognition 1(4), 91–107 (2003)
Alshammari, R., Sonamthiang, S., Teimouri, M., Riordan, D.: Using neurofuzzy approach to reduce false positive alerts. In: Proceedings of Fifth Annual Conference on Communication Networks and Services Research (CNSR 2007), pp. 345–349. IEEE Computer Sociey Press, Los Alamitos (2007)
Axelrod, R.: Structure of Decision: The Cognitive Maps of the Political Elites. Princeton University Press, New Jersey (1976)
Denning, D.E.: An intrusion model. IEEE Transactions on Software Engineering SE-13(2), 222–232 (1987)
Depren, O., Topallar, M., Anarim, E., Kemal, C.M.: An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks. Expert Systems with Applications 29, 713–722 (2005)
Dickerson, J.E., Juslin, J., Koukousoula, O., Dickerson, J.A.: Fuzzy intrusion detection. In: Proceedings of IFSA World Congress and 20th North American Fuzzy Information Processing Society (NAFIPS) International Conference, Vancouver, British Columbia (2001)
KDD Cup 1999 Data. Knowledge Discovery in Databases DARPA Archive. Accessed December 2007, http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
Kendall, K.: A database of computer attacks for the evaluation of intrusion detection systems. Master’s thesis, Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, Cambridge, MA (1999)
Kosko, B.: Fuzzy cognitive maps. International Journal of Man-Machine Studies 24, 65–75 (1986)
Kosko, B.: Fuzzy Engineering. Prentice-Hall, Englewood Cliffs (1997)
Lee, S.Y., Kim, Y.S., Lee, B.H., Kang, S., Youn, C.H.: A probe detection model using the analysis of the fuzzy cognitive maps. In: Proceedings of the International Conference on Computational Science and its Applications (ICCSA), vol. 1, pp. 320–328 (2005)
Lee, W., Stolfo, S.J., Mok, K.W.: Adaptive intrusion detection: A data mining approach. Artificial Intelligence Review 14(6), 533–567 (2000)
Liu, Y., Tian, D., Wang, A.: ANNIDS: Intrusion detection system based on artificial neural network. In: Proceedings of the Second International Conference on Machine Learning and Cybernetics, Xi’an (2003)
MIT Lincoln Lab: DARPA Intrusion Detection Evaluation Plan. Accessed December 2007, http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.html
Peddabachigari, S., Abraham, A., Grosan, C., Thomas, J.: Modelling intrusion detection system using hybrid intelligent systems. Journal of Network and Computer Applications (2005), DOI 10.1016/j.jnca.2005.06.003
Sarasamma, S.T., Zhu, Q.A., Huff, J.: Hierarchal kohonenen net for anomaly detection in network security. IEEE Transactions on Systems, Man, and Cybernetics- Part B: Cybernetics 35(2), 302–312 (2005)
Siraj, A., Vaughn, R.B., Bridges, S.M.: Intrusion sensor data fusion in an intelligent intrusion detection system architecture. In: Proceedings of the 37th Hawaii International Conference on System Sciences (2004)
Stylios, C.D., Groumpos, P.P.: Mathematical formulation of fuzzy cognitive maps. In: Proceedings of the 7th Mediterranean Conference on Control and Automation (MED 1999), Haifa, Israel (1999)
Toosi, A.N., Kahani, M.: A new approach to intrusion detection based on an evolutionary soft computing model using neuro-fuzzy classifiers. Computer Communications 30, 2201–2212 (2007)
Author information
Authors and Affiliations
Editor information
Rights and permissions
Copyright information
© 2008 Springer-Verlag Berlin Heidelberg
About this chapter
Cite this chapter
Jazzar, M., Jantan, A. (2008). An Approach for Anomaly Intrusion Detection Based on Causal Knowledge-Driven Diagnosis and Direction. In: Lee, R. (eds) Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing. Studies in Computational Intelligence, vol 149. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-70560-4_4
Download citation
DOI: https://doi.org/10.1007/978-3-540-70560-4_4
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-70559-8
Online ISBN: 978-3-540-70560-4
eBook Packages: EngineeringEngineering (R0)