Prospective Directions of Traffic Analysis and Intrusion Detection Based on Neural Networks

Abstract

The main problems of the network security at the moment are the difficulty of combining existing systems from different vendors and ensuring their stable interaction with each other. Intrusion detection is one of the main tasks of a proper level of network security, because it is they who notify about attacks and can block them when detected. Today, monitoring and analyzing the quality of traffic in the network, detecting and preventing intrusions is helped by IDS systems and IDS systems of the new generation IPS. However, they have been found to have certain drawbacks, such as the limitations of signature-based systems, as static attack signatures limit the flexibility of systems and pose the threat of missing detection of other attacks not entered into the database. This gives rise to the creation of more and more new hybrid systems, but the challenge is to ensure their efficiency and flexibility, which is helped by the use of artificial neural networks (ANNs). This paper considers ways to improve the use of the convolutional neural network model itself by means of modified processing, data analysis, the use of Softmax and FocalLoss functions to avoid the problem of uneven distribution of sample data by the ratio of positive and negative samples, based on training using the KDD99 dataset. The article provides practical examples of possible integration of IDS and ANN systems. Combinations of backpropagation neural networks and radiant-basis neural networks, which showed some of the best results and proved that the combination of networks helps to increase the efficiency of these systems and create a flexible network adjusted to the needs and requirements of the systems. Although the use of artificial neural networks is a popular tool, it has identified a number of disadvantages: critical dependence on the quality of the dataset, which pours both the quality of networking and the amount of data (the more data, the better and more accurate the network training). But if the data is excessive, there is a chance of missing such implicit, but also dangerous attacks as R2L and U2R.