An overview of neural networks use in anomaly Intrusion Detection Systems
---
paper_title: An Intrusion-Detection Model

paper_content:

A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system.
---
paper_title: Intrusion Detection Using an Ensemble of Intelligent Paradigms

paper_content:

Soft computing techniques are increasingly being used for problem solving. This paper addresses using an ensemble approach of different soft computing and hard computing techniques for intrusion detection. Due to increasing incidents of cyber attacks, building effective intrusion detection systems are essential for protecting information systems security, and yet it remains an elusive goal and a great challenge. We studied the performance of Artificial Neural Networks (ANNs), Support Vector Machines (SVMs) and Multivariate Adaptive Regression Splines (MARS). We show that an ensemble of ANNs, SVMs and MARS is superior to individual approaches for intrusion detection in terms of classification accuracy.
---
paper_title: Evolutionary neural networks for anomaly detection based on the behavior of a program

paper_content:

The process of learning the behavior of a given program by using machine-learning techniques (based on system-call audit data) is effective to detect intrusions. Rule learning, neural networks, statistics, and hidden Markov models (HMMs) are some of the kinds of representative methods for intrusion detection. Among them, neural networks are known for good performance in learning system-call sequences. In order to apply this knowledge to real-world problems successfully, it is important to determine the structures and weights of these call sequences. However, finding the appropriate structures requires very long time periods because there are no suitable analytical solutions. In this paper, a novel intrusion-detection technique based on evolutionary neural networks (ENNs) is proposed. One advantage of using ENNs is that it takes less time to obtain superior neural networks than when using conventional approaches. This is because they discover the structures and weights of the neural networks simultaneously. Experimental results with the 1999 Defense Advanced Research Projects Agency (DARPA) Intrusion Detection Evaluation (IDEVAL) data confirm that ENNs are promising tools for intrusion detection.
---
paper_title: The affect of fuzzification on neural networks intrusion detection system

paper_content:

Intrusion detection (ID) is an interesting approach that could be used to improve the security of network systems. IDS detects suspected patterns of network traffic on the remaining open parts through monitoring user activities (runtime gathering of data from system operations), and the subsequent analysis of these activities. The purpose of this work is to contribute ideas of finding a solution to detect attacks (Intrusion) through building artificial detection system using feedforward neural networks to detect attacks with low false negative rate (which is the most important point), and low false positive rate. To do so, two feedforward neural networks architectures (one for non fuzzified data, the other for fuzzified data) are suggested, and their behaviors in detecting the attacks are studied. In this research, the suggested IDS not only has the ability to distinguish if the access is normal or attack, but also capable of distinguishing the attack type.
---
paper_title: Artificial Neural Networks for Misuse Detection

paper_content:

Misuse detection is the process of attempting to identify instances of network attacks by comparing current activity against the expected actions of an intruder. Most current approaches to misuse detection involve the use of rule-based expert systems to identify indications of known attacks. However, these techniques are less successful in identifying attacks which vary from expected patterns. Artificial neural networks provide the potential to identify and classify network activity based on limited, incomplete, and nonlinear data sources. We present an approach to the process of misuse detection that utilizes the analytical strengths of neural networks, and we provide the results from our preliminary analysis of this approach.
---
paper_title: A survey of intrusion detection techniques

paper_content:

Today's computer systems are vulnerable both to abuse by insiders and to penetration by outsiders, as evidenced by the growing number of incidents reported in the press. To close all security loopholes from today's systems is infeasible, and no combination of technologies can prevent legitimate users from abusing their authority in a system; thus auditing is viewed as the last line of defense. Over the past several years, the computer security community has been developing automated tools to analyze computer system audit data for suspicious user behavior. This paper describes the use of such tools for detecting computer system intrusion and describes further technologies that may be of use for intrusion detection in the future.
---
paper_title: The self-organizing map

paper_content:

The self-organized map, an architecture suggested for artificial neural networks, is explained by presenting simulation experiments and practical applications. The self-organizing map has the property of effectively creating spatially organized internal representations of various features of input signals and their abstractions. One result of this is that the self-organization process can discover semantic relationships in sentences. Brain maps, semantic maps, and early work on competitive learning are reviewed. The self-organizing map algorithm (an algorithm which order responses spatially) is reviewed, focusing on best matching cell selection and adaptation of the weight vectors. Suggestions for applying the self-organizing map algorithm, demonstrations of the ordering process, and an example of hierarchical clustering of data are presented. Fine tuning the map by learning vector quantization is addressed. The use of self-organized maps in practical speech recognition and a simulation experiment on semantic mapping are discussed. >
---
paper_title: DoS Attacks Intelligent Detection using Neural Networks

paper_content:

The potential damage to computer networks keeps increasing due to a growing reliance on the Internet and more extensive connectivity. Intrusion detection systems (IDSs) have become an essential component of computer security to detect attacks that occur despite the best preventative measures. A problem with current intrusion detection systems is that they have many false positive and false negative events. Most of the existing Intrusion detection systems implemented nowadays depend on rule-based expert systems where new attacks are not detectable. In this paper, a possible application of Neural Networks is presented as a component of an intrusion detection system. An intrusion detection system called Denial of Service Intelligent Detection (DoSID) is developed. The type of Neural Network used to implement DoSID is feed forward which uses the backpropagation learning algorithm. The data used in training and testing is the data collected by Lincoln Labs at MIT for an intrusion detection system evaluation sponsored by the U.S. Defense Advanced Research Projects Agency (DARPA). Special features of connection records have been identified to be used in DoS (Denial-of-Service) attacks. Several experiments have been conducted to test the ability of the neural network to distinguish known and unknown attacks from normal traffic. Results show that normal traffic and know attacks are discovered 91% and 100% respectively. Also it has been shown in the final experiment that the false negative of the system has been reduced considerably.
---
paper_title: Artificial Neural Networks for Misuse Detection

paper_content:

Misuse detection is the process of attempting to identify instances of network attacks by comparing current activity against the expected actions of an intruder. Most current approaches to misuse detection involve the use of rule-based expert systems to identify indications of known attacks. However, these techniques are less successful in identifying attacks which vary from expected patterns. Artificial neural networks provide the potential to identify and classify network activity based on limited, incomplete, and nonlinear data sources. We present an approach to the process of misuse detection that utilizes the analytical strengths of neural networks, and we provide the results from our preliminary analysis of this approach.
---
paper_title: Intrusion Detection with Neural Networks

paper_content:

With the rapid expansion of computer networks during the past few years, security has become a crucial issue for modern computer systems. A good way to detect illegitimate use is through monitoring unusual user activity. Methods of intrusion detection based on hand-coded rule sets or predicting commands on-line are laborous to build or not very reliable. This paper proposes a new way of applying neural networks to detect intrusions. We believe that a user leaves a 'print' when using the system; a neural network can be used to learn this print and identify each user much like detectives use thumbprints to place people at crime scenes. If a user's behavior does not match his/her print, the system administrator can be alerted of a possible security breech. A backpropagation neural network called NNID (Neural Network Intrusion Detector) was trained in the identification task and tested experimentally on a system of 10 users. The system was 96% accurate in detecting unusual activity, with 7% false alarm rate. These results suggest that learning user profiles is an effective way for detecting intrusions.
---
paper_title: Learning Program Behavior Profiles for Intrusion Detection

paper_content:

Profiling the behavior of programs can be a useful reference for detecting potential intrusions against systems. This paper presents three anomaly detection techniques for profiling program behavior that evolve from memorization to generalization. The goal of monitoring program behavior is to be able to detect potential intrusions by noting irregularities in program behavior. The techniques start from a simple equality matching algorithm for determining anomalous behavior, and evolve to a feed-forward backpropagation neural network for learning program behavior, and finally to an Elman network for recognizing recurrent features in program execution traces. In order to detect future attacks against systems, intrusion detection systems must be able to generalize from past observed behavior. The goal of this research is to employ machine learning techniques that can generalize from past observed behavior to the problem of intrusion detection. The performance of these systems is compared by testing them with data provided by the DARPA Intrusion Detection Evaluation program.
---
paper_title: Network-based intrusion detection using neural networks

paper_content:

With the growth of computer networking, electronic commerce, and web services, security of networking systems has become very important. Many companies now rely on web services as a major source of revenue. Computer hacking poses significant problems to these companies, as distributed attacks can render their cyber-storefront inoperable for long periods of time. This happens so often, that an entire area of research, called Intrusion Detection, is devoted to detecting this activity. We show that evidence of many of these attacks can be found by a careful analysis of network data. We also illustrate that neural networks can efficiently detect this activity. We test our systems against denial of service attacks, distributed denial of service attacks, and portscans. In this work, we explore network based intrusion detection using classifying, self-organizing maps for data clustering and MLP neural networks for detection.
---

Title: An Overview of Neural Networks Use in Anomaly Intrusion Detection Systems

Section 1: INTRODUCTION
Description 1: Provide a general overview of the importance of network security, how Intrusion Detection Systems (IDS) fit into this context, and the role of artificial intelligence, particularly neural networks, in enhancing IDS.

Section 2: INTRUSION DETECTION SYSTEMS
Description 2: Discuss the key functions of IDS, differentiating between Host-based IDSs and Network-based IDSs, and classify IDSs into misuse detection and anomaly detection.

Section 3: Approaches for anomaly detection 
Description 3: Describe various approaches for anomaly detection in IDSs, including threshold detection, statistical measures, rule-based measures, and non-linear algorithms like neural networks, and genetic algorithms.

Section 4: NEURAL NETWORK CONCEPTS
Description 4: Introduce the concept of neural networks, their architecture (e.g., feedforward, recurrent networks), and their potential for training and adaptability in pattern recognition and learning in the context of IDS.

Section 5: NEURAL NETWORK AND IDS
Description 5: Explain how neural networks are employed to address the shortcomings of anomaly detection IDS, including their advantages in statistical modeling, scalability, and error rate reduction, and discuss pattern recognition and classification techniques.

Section 6: IMPLEMENTATIONS OF NEURAL NETWORK IDS
Description 6: Review various implementations of neural network-based IDS, highlighting significant research works and systems such as NNID, the work by Cannady, and multi-class detection systems.

Section 7: CONCLUSIONS
Description 7: Summarize the key points discussed in the paper, including the comparison of IDS types and the benefits of integrating neural networks into anomaly detection systems, concluding with examples of practical implementations.