Intrusion detection system modeling based on neural networks and fuzzy logic

Midzic, Admir; Avdagić, Zikrija; Omanović, Samir

doi:10.1109/ines.2016.7555118

Cited by 10 publications

(12 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our further experiments with this architecture [36] didn't give expected results and this architecture is abandoned. SOM, ANFIS [34], KDD CUP 99…”

Section: Method(s) and Datasetmentioning

confidence: 99%

“…gives an overview of the most important IDS related publications for this research where fuzzy logic and/or neural networks where used. [16], [19], [20], [33] Fuzzy logic [17] Hybridizations like Adaptive Neuro-Fuzzy Inference System (ANFIS) [1], [21], [34] Comparison of IDSs can be done in many different ways. Typically, IDS prediction performance estimation includes Detection Rate (DR) and False Alarm Rate (FAR) (see Table 2).…”

Section: Related Workmentioning

confidence: 99%

“…However, it is noted that usage of SOM and ANFIS is a good way for further research. The second paper [34] presents multilayer architecture with SOM and ANFIS which had some shortcomings which are resolved in the architecture proposed in this manuscript and tested on dataset [37], [38] (that is extracted form dataset [39] used in previous research). The model presented in this manuscript has been developed as two step process.…”

Section: Related Workmentioning

confidence: 99%

“…In [34] we have used static value for numer of nodes (25) and that was the number of the neurons in the second layer for each of 32 cluster in first SOM layer. In this manuscript we have used improved version of algorithm for creation the SOM in second layer.…”

Section: Related Workmentioning

confidence: 99%

“…Another improvement is made during FIS creation using another SOM. Fuzzy system [34] is formed by using ANFIS on training data set when system is trained in several iterations. Training data were first divided into different training matrices.…”

Section: Related Workmentioning

confidence: 99%

See 4 more Smart Citations

Intrusion Detection System Modeling Based on Learning from Network Traffic Data

2018

TIIS

View full text Add to dashboard Cite

This research uses artificial intelligence methods for computer network intrusion detection system modeling. Primary classification is done using self-organized maps (SOM) in two levels, while the secondary classification of ambiguous data is done using Sugeno type Fuzzy Inference System (FIS). FIS is created by using Adaptive Neuro-Fuzzy Inference System (ANFIS). The main challenge for this system was to successfully detect attacks that are either unknown or that are represented by very small percentage of samples in training dataset. Improved algorithm for SOMs in second layer and for the FIS creation is developed for this purpose. Number of clusters in the second SOM layer is optimized by using our improved algorithm to minimize amount of ambiguous data forwarded to FIS. FIS is created using ANFIS that was built on ambiguous training dataset clustered by another SOM (which size is determined dynamically). Proposed hybrid model is created and tested using NSL KDD dataset. For our research, NSL KDD is especially interesting in terms of class distribution (overlapping). Objectives of this research were: to successfully detect intrusions represented in data with small percentage of the total traffic during early detection stages, to successfully deal with overlapping data (separate ambiguous data), to maximize detection rate (DR) and minimize false alarm rate (FAR). Proposed hybrid model with test data achieved acceptable DR value 0.8883 and FAR value 0.2415. The objectives were successfully achieved as it is presented (compared with the similar researches on NSL KDD dataset). Proposed model can be used not only in further research related to this domain, but also in other research areas. had shortcomings. They are resolved in the architecture proposed in this manuscript. The main improvement is related to optimization in the second SOM layer using an improved algorithm while keeping acceptable level of DR and FAR. Furthermore, the amount of ambiguous traffic samples that are forwarded to FIS for further analysis is minimized.

show abstract

“…Our further experiments with this architecture [36] didn't give expected results and this architecture is abandoned. SOM, ANFIS [34], KDD CUP 99…”

Section: Method(s) and Datasetmentioning

confidence: 99%