Flow-Based Anomaly Detection Using Neural Network Optimized with GSA Algorithm
- 1 July 2013
- conference paper
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE) in 2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops
Abstract
Reliable high-speed networks are essential to provide quality services to ever growing Internet applications. A Network Intrusion Detection System (NIDS) is an important tool to protect computer networks from attacks. Traditional packet-based NIDSs are time-intensive as they analyze all network packets. A state-of-the-art NIDS should be able to handle a high volume of traffic in real time. Flow-based intrusion detection is an effective method for high speed networks since it inspects only packet headers. The existence of new attacks in the future is another challenge for intrusion detection. Anomaly-based intrusion detection is a well-known method capable of detecting unknown attacks. In this paper, we propose a flow-based anomaly detection system. Artificial Neural Network (ANN) is an important approach for anomaly detection. We used a Multi-Layer Perceptron (MLP) neural network with one hidden layer. We investigate the use of a Gravitational Search Algorithm (GSA) in optimizing interconnection weights of a MLP network. Our proposed GSA-based flow anomaly detection system (GFADS) is trained with a flow-based data set. The trained system can classify benign and malicious flows with 99.43% accuracy. We compare the performance of GSA with traditional gradient descent training algorithms and a particle swarm optimization (PSO) algorithm. The results show that GFADS is effective in flow-based anomaly detection. Finally, we propose a four-feature subset as the optimal set of features.Keywords
This publication has 13 references indexed in Scilit:
- Particle swarm optimizationPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2014
- A prototype classifier based on gravitational search algorithmApplied Soft Computing, 2012
- Statistical Normalization and Back Propagationfor ClassificationInternational Journal of Computer Theory and Engineering, 2011
- HiFIND: A high-speed flow-level intrusion detection approach with DoS resiliencyComputer Networks, 2010
- An Overview of IP Flow-Based Intrusion DetectionIEEE Communications Surveys & Tutorials, 2010
- Machine learning based encrypted traffic classification: Identifying SSH and SkypePublished by Institute of Electrical and Electronics Engineers (IEEE) ,2009
- GSA: A Gravitational Search AlgorithmInformation Sciences, 2009
- Architecture for Applying Data Mining and Visualization on Network Flow for Botnet Traffic DetectionPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2009
- Conceptual Integration of Flow-Based and Packet-Based Network Intrusion DetectionLecture Notes in Computer Science, 2008
- Flow Anomaly Detection in Firewalled NetworksPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2006