Heather Ames
Chuan-Heng Chsiao
Chaitanya Sai Gaddam
13 February 2006
CN710 Discussion Proposal: Network Intrusion Detection
The increase in the amount of data stored electronically, by average consumers and
companies, has made the issue of data privacy and tampering a critical one. Attempts to
remotely connect to computers or networks to gain illegal access to such data are labeled
intrusion attempts. Automated early detection of such behavior can greatly help network
administrators in safeguarding systems. As can be expected, these attacks can vary
greatly in terms of what inputs of malicious users look like in log files over time, and
within the file itself. Learning systems are applied with the hope of building classifiers
that are able to highlight previously known intrusion tactics as well as novel, deviant
behavior. We will discuss the use of various classifiers and pre-processing techniques on
such datasets, and the paradigm of artificial Immune Systems, which seems to be
currently popular with researchers in this field.
Some of the papers proposed as readings discuss the use of the KDD cup 1999 data set.
The 1999 edition of the Knowledge Discovery in Databases (KDD) Cup, an annual
competition organized by an ACM special interest group, looked specifically at the issue
of network intrusion. The data used for the contest is from the two month log of the US
Air Force, and has been classified as 24 different classes (one class labeled normal, and
the others being labeled abnormal network connections.) The features are also abstracted
as 41 features (according to the network headers.) There are roughly five million training
data points and about three million testing data points. This data set could help provide an
intuitive feel for the problem at hand and aid speculation about the type of supervised
learning algorithm most suited for the task. We suggest looking at the dataset and training
readily available classifier implementations with it.
References
Core Readings
de Castro, L.N. & Timmis, J. Artificial Immune Systems: A Novel Paradigm to Pattern
Recognition. Artificial Neural Networks in Pattern Recognition, University of Paisley,
2002.
This article introduces Artificial Immune Systems; explores the computational
analogies to biological immune networks.
1
Aickelin, U., Greensmith, J., & Twycross, J. Immune system approaches to intrusion
detection, a review. Giuseppe Nicosia, Vincenzo Cutello, P.J.B., ed.: Lecture Notes in
Computer Science, 3239 p. 316-329, 2004.
A review paper describing the developments in the use of the immune system
metaphor to Intrusion Detection.
Kim, D. S & Park, J. S. Network-Based Intrusion Detection with Support Vector
Machines. Lecture Notes in Computer Science, 2662 p.747-756, 2003.
The article details the use of SVM's to this problem.
Rawat, S. & Sastry. J, C. Network Intrusion Detection Using Wavelet Analysis. CIT,
LNCS 3356 p. 224-232, 2004.
The article describes the use of wavelets in analyzing network traffic.
|Cannady, J. & Garcia, R. C. The Application of Fuzzy ARTMAP in the Detection of
Computer Network Attacks. Lecture Notes in Computer Science. 2130 p. 225-230, 2001.
The article describes the use of Fuzzy-ARTMAP in the detection of network
intrusion.
Supplementary Readings
Kim, J. & Bentley, P. The Human Immune System and Network Intrusion Detection. 7th
European Conference on Intelligent Techniques and Soft Computing (EUFIT '99),
Aachen, Germany, 1999.
This article gives an overview of the desirable properties of an intrusion detection
system, and really stretches the analogy to immune systems to its limits.
Kim, J. & Bentley, P. The artificial immune model for network intrusion detection. 7th
European Conference on Intelligent Techniques and Soft Computing (EUFIT’99),
Aachen, Germany 1999a.
This article focuses on the artificial immune system model. Light on
implementation details and results, but is worth a quick read.
Timmis, J., Knight, T., de Castro, L. N., & Hart E. An overview of artificial immune
systems. Computation in Cells and Tissues: Perspectives and tools for thought. Natural
Computation Series, p. 51-86, 2004.
A more in-depth look at artificial immune systems.
2