Multi Scale Time Series Prediction for Intrusion Detection

Abstract

We propose an anomaly-based network intrusion detection system, which analyzes traffic features to detect anomalies. The proposed system can be used both in online as well as off-line mode for detecting deviations from the expected behavior. Although our approach uses network packet or flow data, it is general enough to be adaptable for use with any other network variable, which may be used as a signal for anomaly detection. It differs from most existing approaches in its use of wavelet transform for generating different time scales for a signal and using these scales as an input to a two-stage neural network predictor. The predictor predicts the expected signal value and labels considerable deviations from this value as anomalies. The primary contribution of our work would be to empirically evaluate the effectiveness of multi resolution analysis as an input to neural network prediction engine specifically for the purpose of intrusion detection. The role of Intrusion Detection Systems (IDSs), as special-purpose devices to detect anomalies and attacks in a network, is becoming more important. First, anomaly-based methods cannot achieve an outstanding performance without a comprehensive labeled and up-to-date training set with all different attack types, which is very costly and time-consuming to create if not impossible. Second, efficient and effective fusion of several detection technologies becomes a big challenge for building an operational hybrid intrusion detection system.

Discrete Event, Continuous Time RNNs

“…However, convolutional architectures poorly address the continuous nature of time and the potential wide range of time scales. Consider a domain such as network intrusion detection: event patterns of relevance can occur on a time scale of microseconds to weeks (Mukherjee et al, 1994;Palanivel and Duraiswamy, 2014). It is difficult to conceive how a convolutional architecture could accommodate this dynamic range.…”