• KSII Transactions on Internet and Information Systems
    Monthly Online Journal (eISSN: 1976-7277)

Intrusion Detection System Modeling Based on Learning from Network Traffic Data

Vol. 12, No.11, November 30, 2018
10.3837/tiis.2018.11.022 , Download Paper (Free):

Abstract

This research uses artificial intelligence methods for computer network intrusion detection system modeling. Primary classification is done using self-organized maps (SOM) in two levels, while the secondary classification of ambiguous data is done using Sugeno type Fuzzy Inference System (FIS). FIS is created by using Adaptive Neuro-Fuzzy Inference System (ANFIS). The main challenge for this system was to successfully detect attacks that are either unknown or that are represented by very small percentage of samples in training dataset. Improved algorithm for SOMs in second layer and for the FIS creation is developed for this purpose. Number of clusters in the second SOM layer is optimized by using our improved algorithm to minimize amount of ambiguous data forwarded to FIS. FIS is created using ANFIS that was built on ambiguous training dataset clustered by another SOM (which size is determined dynamically). Proposed hybrid model is created and tested using NSL KDD dataset. For our research, NSL KDD is especially interesting in terms of class distribution (overlapping). Objectives of this research were: to successfully detect intrusions represented in data with small percentage of the total traffic during early detection stages, to successfully deal with overlapping data (separate ambiguous data), to maximize detection rate (DR) and minimize false alarm rate (FAR). Proposed hybrid model with test data achieved acceptable DR value 0.8883 and FAR value 0.2415. The objectives were successfully achieved as it is presented (compared with the similar researches on NSL KDD dataset). Proposed model can be used not only in further research related to this domain, but also in other research areas.


Statistics

Show / Hide Statistics

Statistics (Cumulative Counts from December 1st, 2015)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article

[IEEE Style]
Admir Midzic, Zikrija Avdagic and Samir Omanovic, "Intrusion Detection System Modeling Based on Learning from Network Traffic Data," KSII Transactions on Internet and Information Systems, vol. 12, no. 11, pp. 5568-5587, 2018. DOI: 10.3837/tiis.2018.11.022

[ACM Style]
Midzic, A., Avdagic, Z., and Omanovic, S. 2018. Intrusion Detection System Modeling Based on Learning from Network Traffic Data. KSII Transactions on Internet and Information Systems, 12, 11, (2018), 5568-5587. DOI: 10.3837/tiis.2018.11.022