Computer Network Intrusion Detection

A typical problem that arises when deploying intrusion detection sensors is their affinities of producing high rate of false alerts. Thus, it needs huge analysis efforts and time consuming odd jobs at higher levels. In this study, we have investigated an approach to anomaly intrusion detection based on causal knowledge reasoning. The approach is anomaly-based and utilizes causal knowledge inference based fuzzy cognitive maps (FCM) and self organizing maps (SOM). A set of parallel neural network classifiers (SOM) are used to do an initial recognition of the network traffic flow to detect abnormal behaviors. The FCM is incorporated to eliminate ambiguities of odd neurons and making final decisions. Based on the domain knowledge of network data the SOM/FCM combination presents quantitative and qualitative matching correspondences which in turn reduce the number of suspicious neurons i.e. reduce the number of false alerts. This method works as a unique fuzzy clustering approach and we have demonstrated its performance using DARPA 1999 network traffic data set. The method has also the flexibility of features selection for further exploration.

Autorentext

Mahmoud Jazzar was conferred the PhD degree in Computer Science from University Sains Malaysia, during August 2009. He has taught and supervised several B.S. and M.S. projects in various Computer Science and Network Security topics. Currently, Dr. Jazzar is the Dean of the Faculty of Information Technology, Royal University for Women, Bahrain.