Neural visualization of network traffic data for intrusion detection

Abstract

-This study introduces and describes a novel Intrusion Detection System (IDS) called MOVCIDS (MObile Visualization Connectionist IDS). This system applies neural projection architectures to detect anomalous situations taking place in a computer network. By its advanced visualization facilities, the proposed IDS allows providing an overview of the network traffic as well as identifying anomalous situations tackled by computer networks, responding to the challenges presented by volume, dynamics and diversity of the traffic, including novel (0-day) attacks. MOVCIDS provides a novel point of view in the field of IDSs by enabling the most interesting projections (based on the fourth order statistics; the kurtosis index) of a massive traffic dataset to be extracted. These projections are then depicted through a functional and mobile visualization interface, providing visual information of the internal structure of the traffic data. The interface makes MOVCIDS accessible from any mobile device to give more accessibility to network administrators, enabling continuous visualization, monitoring and supervision of computer networks. Additionally, a novel testing technique has been developed to evaluate MOVCIDS and other IDSs employing numerical datasets. To show the performance and validate the proposed IDS, it has been tested in different real domains containing several attacks and anomalous situations. In addition, the importance of the temporal dimension on intrusion detection, and the ability of this IDS to process it, are emphasized in this work.

Incorporating Temporal Constraints in the Analysis Task of a Hybrid Intelligent IDS

“…The effectiveness of MOVICAB-IDS in facing some anomalous situations has been widely demonstrated in previous works [2], [3], [22]. It identifies anomalous situations due to the fact that these situations do not tend to resemble parallel and smooth directions (normal situations) or because their high temporal concentration of packets.…”

“…MOVICAB-IDS (MObile VIsualisation Connectionist AgentBased IDS) has been proposed [2,3] as a novel IDS employing CI techniques to monitor the network activity. Different CI paradigms are combined to visualise network traffic for Intrusion Detection (ID) at packet level.…”

Testing Ensembles for Intrusion Detection: On the Identification of Mutated Network Scans

“…Real-life datasets have been previously applied to perform ID [16], [17], it has been proved that this low-dimensional datasets allow the detection of some anomalous situations [11]. Packets travelling along the network are characterized by using a set of features, extracted from the packet headers contribute to build up the neuralnetwork input vector, x  5 ; these features can be listed as follows:  Timestamp: the time the packet was sent.…”

“…The proposed mutation testing model was previously applied to a visualizationbased IDS [16], [17] and is based on mutating attack traffic. In general, a mutation can be defined as a random change.…”

“…Previous works have presented several techniques to test and evaluate misuse detection models for network-based IDSs. A testing technique to prove the effectiveness and capability of any visualization-based IDS, employing numerical data to confront unknown attacks has been previously proposed [16], [17]. In this case, the method is used to asses different classifiers in the detection of mutated network scans.…”