A Mutated Intrusion Detection System Using Principal Component Analysis and Time Delay Neural Network
The Intrusion Detection System (IDS) is generally used the misuse detection model based on rules because this model has low false alarm rates. However, the rule based IDSs are not efficient for mutated attacks, because they need additional rules for the variations of the attacks. In this paper, we propose an intrusion detection system using the Principal Component Analysis (PCA) and the Time Delay Neural Network (TDNN). Packets on the network can be considered as gray images of which pixels represent bytes of the packets. From these continuous packet images, we extract principal components. And these components are used as an input of a TDNN classifier that discriminates between normal and abnormal packet flows. The system deals well with various mutated attacks, as well as well-known attacks.
KeywordsPrincipal Component Analysis Intrusion Detection System Normal Packet Signature Database Time Delay Neural Network
Unable to display preview. Download preview PDF.
- 5.McCanne, S., Jacobson, V.: The BSD Packet Filter: A New Architecture for User-level Packet Capture. In: Proceedings of the 1993 Winter USENIX Conference, pp. 259–269 (1993)Google Scholar
- 6.Quinn, B., Shute, D.: Windows Sockets Network Programming. Addison-Wesley Professional, Reading (1996)Google Scholar
- 7.Johnson, R.A., Wichern, D.W.: Applied Multivariate Statistical Analysis, pp. 356–395. Prentice-Hall, Englewood Cliffs (2002)Google Scholar