An Approach for Anomaly Intrusion Detection Based on Causal Knowledge-Driven Diagnosis and Direction

  • Mahmoud Jazzar
  • Aman Jantan
Part of the Studies in Computational Intelligence book series (SCI, volume 149)


Conventional knowledge acquisition methods such as semantic knowledge, production rules and question answering systems have been addressed to a variety of typical knowledge based systems. However, very limited causal knowledge based methods have been addressed to the problem of intrusion detection. In this paper, we propose an approach based on causal knowledge reasoning for anomaly intrusion detection. Fuzzy cognitive maps (FCM) are ideal causal knowledge acquiring tool with fuzzy signed graphs which can be presented as an associative single layer neural network. Using FCM, our methodology attempt to diagnose and direct network traffic data based on its relevance to attack or normal connections. By quantifying the causal inference process we can determine the attack detection and the severity of odd packets. As such packets with low causal relations to attacks can be dropped or ignored and/or packets with high causal relations to attacks are to be highlighted.


Intrusion detection False alerts Fuzzy cognitive maps Security 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Aguilar, J.: A dynamic fuzzy-cognitive-map approach based on random neural networks. International Journal of Computational Cognition 1(4), 91–107 (2003)Google Scholar
  2. 2.
    Alshammari, R., Sonamthiang, S., Teimouri, M., Riordan, D.: Using neurofuzzy approach to reduce false positive alerts. In: Proceedings of Fifth Annual Conference on Communication Networks and Services Research (CNSR 2007), pp. 345–349. IEEE Computer Sociey Press, Los Alamitos (2007)CrossRefGoogle Scholar
  3. 3.
    Axelrod, R.: Structure of Decision: The Cognitive Maps of the Political Elites. Princeton University Press, New Jersey (1976)Google Scholar
  4. 4.
    Denning, D.E.: An intrusion model. IEEE Transactions on Software Engineering SE-13(2), 222–232 (1987)CrossRefGoogle Scholar
  5. 5.
    Depren, O., Topallar, M., Anarim, E., Kemal, C.M.: An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks. Expert Systems with Applications 29, 713–722 (2005)CrossRefGoogle Scholar
  6. 6.
    Dickerson, J.E., Juslin, J., Koukousoula, O., Dickerson, J.A.: Fuzzy intrusion detection. In: Proceedings of IFSA World Congress and 20th North American Fuzzy Information Processing Society (NAFIPS) International Conference, Vancouver, British Columbia (2001)Google Scholar
  7. 7.
    KDD Cup 1999 Data. Knowledge Discovery in Databases DARPA Archive. Accessed December 2007,
  8. 8.
    Kendall, K.: A database of computer attacks for the evaluation of intrusion detection systems. Master’s thesis, Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, Cambridge, MA (1999)Google Scholar
  9. 9.
    Kosko, B.: Fuzzy cognitive maps. International Journal of Man-Machine Studies 24, 65–75 (1986)MATHCrossRefGoogle Scholar
  10. 10.
    Kosko, B.: Fuzzy Engineering. Prentice-Hall, Englewood Cliffs (1997)MATHGoogle Scholar
  11. 11.
    Lee, S.Y., Kim, Y.S., Lee, B.H., Kang, S., Youn, C.H.: A probe detection model using the analysis of the fuzzy cognitive maps. In: Proceedings of the International Conference on Computational Science and its Applications (ICCSA), vol. 1, pp. 320–328 (2005)Google Scholar
  12. 12.
    Lee, W., Stolfo, S.J., Mok, K.W.: Adaptive intrusion detection: A data mining approach. Artificial Intelligence Review 14(6), 533–567 (2000)MATHCrossRefGoogle Scholar
  13. 13.
    Liu, Y., Tian, D., Wang, A.: ANNIDS: Intrusion detection system based on artificial neural network. In: Proceedings of the Second International Conference on Machine Learning and Cybernetics, Xi’an (2003)Google Scholar
  14. 14.
    MIT Lincoln Lab: DARPA Intrusion Detection Evaluation Plan. Accessed December 2007,
  15. 15.
    Peddabachigari, S., Abraham, A., Grosan, C., Thomas, J.: Modelling intrusion detection system using hybrid intelligent systems. Journal of Network and Computer Applications (2005), DOI 10.1016/j.jnca.2005.06.003Google Scholar
  16. 16.
    Sarasamma, S.T., Zhu, Q.A., Huff, J.: Hierarchal kohonenen net for anomaly detection in network security. IEEE Transactions on Systems, Man, and Cybernetics- Part B: Cybernetics 35(2), 302–312 (2005)CrossRefGoogle Scholar
  17. 17.
    Siraj, A., Vaughn, R.B., Bridges, S.M.: Intrusion sensor data fusion in an intelligent intrusion detection system architecture. In: Proceedings of the 37th Hawaii International Conference on System Sciences (2004)Google Scholar
  18. 18.
    Stylios, C.D., Groumpos, P.P.: Mathematical formulation of fuzzy cognitive maps. In: Proceedings of the 7th Mediterranean Conference on Control and Automation (MED 1999), Haifa, Israel (1999)Google Scholar
  19. 19.
    Toosi, A.N., Kahani, M.: A new approach to intrusion detection based on an evolutionary soft computing model using neuro-fuzzy classifiers. Computer Communications 30, 2201–2212 (2007)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Mahmoud Jazzar
    • 1
  • Aman Jantan
    • 1
  1. 1.School of Computer SciencesUniversiti Sains MalaysiaPulau PinangMalaysia

Personalised recommendations