Building an Intrusion Detection System with Neural Network

• Main Authors: Wei-Chuen Yau, 丘偉權
• Other Authors: Chi-Sung Laih
• Format: Others
• Language: en_US
• Published: 2001
• Online Access: http://ndltd.ncl.edu.tw/handle/07344852846045593073

碩士 === 國立成功大學 === 電機工程學系 === 89 === Previous researches have shown that neural network (NN) is a feasible approach for developing an intrusion detection system (IDS). However, we observe that most of the previous work is valid only for detecting limited kinds of attacks. In addition, there are also little previous efforts in the implementation of a real-time NN-based IDS. This motivates us to investigate the possible methodologies and implementation techniques for developing an NN-based IDS that scale up the detection scope and can perform in real time. This thesis describes the design and implementation of a real-time network-based IDS with NN approach. We first explore the possible input considerations and detection models for this system. Three models, namely service-specific model, attack category model, general TCP model, are investigated. The service-specific model detects the attacks against a specific service. The attack category model detects a category of similar attacks. The general TCP model detects a broad range of TCP attacks. We then employ multilayer perceptrons with back-propagation algorithm to develop the intrusion detection models. These models are trained and tested by some examples and used to distinguish intrusions from normal behaviors. Finally, we implement an IDS prototype system, NeuroIDS, that can perform in real time with a broad detection scope and good detection rate.