Advertisement

A Mutated Intrusion Detection System Using Principal Component Analysis and Time Delay Neural Network

  • Byoung-Doo Kang
  • Jae-Won Lee
  • Jong-Ho Kim
  • O-Hwa Kwon
  • Chi-Young Seong
  • Se-Myung Park
  • Sang-Kyoon Kim
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3973)

Abstract

The Intrusion Detection System (IDS) is generally used the misuse detection model based on rules because this model has low false alarm rates. However, the rule based IDSs are not efficient for mutated attacks, because they need additional rules for the variations of the attacks. In this paper, we propose an intrusion detection system using the Principal Component Analysis (PCA) and the Time Delay Neural Network (TDNN). Packets on the network can be considered as gray images of which pixels represent bytes of the packets. From these continuous packet images, we extract principal components. And these components are used as an input of a TDNN classifier that discriminates between normal and abnormal packet flows. The system deals well with various mutated attacks, as well as well-known attacks.

Keywords

Principal Component Analysis Intrusion Detection System Normal Packet Signature Database Time Delay Neural Network 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Sekar, R., Guang, Y., Verma, S., Shanbhag, T.: A High-Performance Network Intrusion Detection System. In: Proceedings of the 6th ACM Conference on Computer and Communications Security, pp. 8–17. ACM Press, New York (1999)CrossRefGoogle Scholar
  2. 2.
    Paxson, V.: Bro: A System for Detecting Network Intruders in Real-time. Computer Networks 31(23-24), 2435–2463 (1999)CrossRefGoogle Scholar
  3. 3.
    Giacinto, G., Roli, F., Didaci, L.: Fusion of Multiple Classifiers for Intrusion Detection in Computer Networks. Pattern Recognition Letters 24(12), 1795–1803 (2003)CrossRefGoogle Scholar
  4. 4.
  5. 5.
    McCanne, S., Jacobson, V.: The BSD Packet Filter: A New Architecture for User-level Packet Capture. In: Proceedings of the 1993 Winter USENIX Conference, pp. 259–269 (1993)Google Scholar
  6. 6.
    Quinn, B., Shute, D.: Windows Sockets Network Programming. Addison-Wesley Professional, Reading (1996)Google Scholar
  7. 7.
    Johnson, R.A., Wichern, D.W.: Applied Multivariate Statistical Analysis, pp. 356–395. Prentice-Hall, Englewood Cliffs (2002)Google Scholar
  8. 8.
    Waibel, A., Hanazawa, T., Hinton, G., Shikano, K., Lang, K.J.: Phoneme Recognition Using Time-Delay Neural Networks. IEEE Transactions on Acoustics, Speech, and Signal Processing ASSP 37(3), 328–339 (1989)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Byoung-Doo Kang
    • 1
  • Jae-Won Lee
    • 1
  • Jong-Ho Kim
    • 1
  • O-Hwa Kwon
    • 1
  • Chi-Young Seong
    • 1
  • Se-Myung Park
    • 1
  • Sang-Kyoon Kim
    • 1
  1. 1.Department of Computer ScienceInje UniversityKimhaeKorea

Personalised recommendations