EFIS: Evolvable-Neural-Based Fuzzy Inference System and Its Application for Adaptive Network Anomaly Detection
This paper presents an application of a new type of fuzzy inference system, denoted as evolvable-neural-based fuzzy inference system (EFIS), for adaptive network anomaly detection in the presence of a concept drift problem. This problem cannot be avoided to happen in every network. It is a problem of modeling the behavior of normal traffic while it keeps changing over time in continuous manner. EFIS can solve the concept drift problem by having dynamic network traffic profile creation and adaptation. The profile is then being further used to detect anomaly. An enhanced evolving clustering method (ECMm), which is employed by EFIS for online network traffic clustering, is also presented. It is demonstrated, through experiments, that EFIS can evolve in a growing network and also successfully detect network traffic anomalies.
KeywordsIntrusion Detection Network Traffic Fuzzy Inference System Anomaly Detection Intrusion Detection System
Unable to display preview. Download preview PDF.
- 1.Marchette, D.: A Statistical Method for Profiling Network Traffic. In: Workshop on Intrusion Detection and Network Monitor, pp. 119–128 (1999)Google Scholar
- 2.Pasha, M.F., Budiarto, R., Sumari, P., Osman, A.: Data Mining and Rule Generation in Network Traffic using Fuzzy Clustering Techniques. In: MMU International Symposium on Information and Communications Technologies, vol. TS4B-5, pp. 17–20 (2004)Google Scholar
- 3.Budiarto, R., Pasha, M.F.: Developing Online Adaptive Engine for Profiling Network Traffic using Evolving Connectionist Systems. In: Conference on Neuro-Computing and Evolving Intelligence, pp. 69–70 (2004)Google Scholar
- 4.Lampinen, T., Koivisto, H., Honkanen, T.: Profiling Network Application with Fuzzy C-Means Clustering and Self Organizing Map. In: First International Conference on Fuzzy System and Knowledge Discovery: Computational Intelligence for the E-Age, pp. 300–304 (2002)Google Scholar
- 6.Teng, H.S., Chen, K., Lu, S.C.: Adaptive real-time anomaly detection using inductively generated sequential patterns. In: IEEE Symposium on Security and Privacy, pp. 278–284 (1980)Google Scholar
- 7.Lane, T., Brodley, C.: Approaches to online learning and conceptual drift for user identification in computer security. ECE and the COAST Laboratory Tech. Rep. (Coast TR 98-12). Purdue University (1998)Google Scholar
- 8.Cannady, J.: Next generation intrusion detection: Autonomous reinforcement learning of network attacks. In: 23rd National Information Systems Security Conference, pp. 1–12 (2000)Google Scholar
- 9.Hossain, M., Bridges, S.M.: A framework for an adaptive intrusion detection system with data mining. In: 13th Annual Canadian Information Technology Security Symposium (2001)Google Scholar
- 11.Barbara, D., Couto, J., Jajodia, S., Popyack, L., Wu, N.: ADAM: Detecting intrusions by data mining. In: IEEE Workshop on Information Assurance and Security, pp. 11–16 (2001)Google Scholar