Journal's Facebook pageFlow-Based Anomaly Intrusion Detection System Using Two Neural Network Stages
- University of Belgrade, School of Electrical Engineering, Serbia
Bulevar kralja Aleksandra 73, 11120 Belgrade, Serbia
abouadlla@gmail.com - University of Belgrade, School of Electrical Engineering, Serbia
Bulevar kralja Aleksandra 73, 11120 Belgrade, Serbia
kvascev@etf.bg.ac.rs - University of Belgrade, School of Electrical Engineering, Serbia
Bulevar kralja Aleksandra 73, 11120 Belgrade, Serbia
slavko.gajin@rcub.bg.ac.rs - University of Belgrade, School of Electrical Engineering, Serbia
Bulevar kralja Aleksandra 73, 11120 Belgrade, Serbia
zoran@rcub.bg.ac.rs
Abstract
Computer systems and networks suffer due to rapid increase of attacks, and in order to keep them safe from malicious activities or policy violations, there is need for effective security monitoring systems, such as Intrusion Detection Systems (IDS). Many researchers concentrate their efforts on this area using different approaches to build reliable intrusion detection systems. Flow-based intrusion detection systems are one of these approaches that rely on aggregated flow statistics of network traffic. Their main advantages are host independence and usability on high speed networks, since the metrics may be collected by network device hardware or standalone probes. In this paper, an intrusion detection system using two neural network stages based on flow-data is proposed for detecting and classifying attacks in network traffic. The first stage detects significant changes in the traffic that could be a potential attack, while the second stage defines if there is a known attack and in that case classifies the type of attack. The first stage is crucial for selecting time windows where attacks, known or unknown, are more probable. Two different neural network structures have been used, multilayer and radial basis function networks, with the objective to compare performance, memory consumption and the time required for network training. The experimental results demonstrate that the designed models are promising in terms of accuracy and computational time, with low probability of false alarms.
Key words
Intrusion Detection system, Anomaly detection system, Neural Network, NetFlow
Digital Object Identifier (DOI)
https://doi.org/10.2298/CSIS130415035A
Publication information
Volume 11, Issue 2 (June 2014)
Year of Publication: 2014
ISSN: 2406-1018 (Online)
Publisher: ComSIS Consortium
Full text
Available in PDF
Portable Document Format
How to cite
Abuadlla, Y., Kvascev, G., Gajin, S., Jovanovic, Z.: Flow-Based Anomaly Intrusion Detection System Using Two Neural Network Stages. Computer Science and Information Systems, Vol. 11, No. 2, 601-622. (2014), https://doi.org/10.2298/CSIS130415035A
