Flow-Based Anomaly Intrusion Detection System Using Two Neural Network Stages

Yousef Abuadlla1, Goran Kvascev2, Slavko Gajin3 and Zoran Jovanovic4

  1. University of Belgrade, School of Electrical Engineering, Serbia
    Bulevar kralja Aleksandra 73, 11120 Belgrade, Serbia
    abouadlla@gmail.com
  2. University of Belgrade, School of Electrical Engineering, Serbia
    Bulevar kralja Aleksandra 73, 11120 Belgrade, Serbia
    kvascev@etf.bg.ac.rs
  3. University of Belgrade, School of Electrical Engineering, Serbia
    Bulevar kralja Aleksandra 73, 11120 Belgrade, Serbia
    slavko.gajin@rcub.bg.ac.rs
  4. University of Belgrade, School of Electrical Engineering, Serbia
    Bulevar kralja Aleksandra 73, 11120 Belgrade, Serbia
    zoran@rcub.bg.ac.rs

Abstract

Computer systems and networks suffer due to rapid increase of attacks, and in order to keep them safe from malicious activities or policy violations, there is need for effective security monitoring systems, such as Intrusion Detection Systems (IDS). Many researchers concentrate their efforts on this area using different approaches to build reliable intrusion detection systems. Flow-based intrusion detection systems are one of these approaches that rely on aggregated flow statistics of network traffic. Their main advantages are host independence and usability on high speed networks, since the metrics may be collected by network device hardware or standalone probes. In this paper, an intrusion detection system using two neural network stages based on flow-data is proposed for detecting and classifying attacks in network traffic. The first stage detects significant changes in the traffic that could be a potential attack, while the second stage defines if there is a known attack and in that case classifies the type of attack. The first stage is crucial for selecting time windows where attacks, known or unknown, are more probable. Two different neural network structures have been used, multilayer and radial basis function networks, with the objective to compare performance, memory consumption and the time required for network training. The experimental results demonstrate that the designed models are promising in terms of accuracy and computational time, with low probability of false alarms.

Key words

Intrusion Detection system, Anomaly detection system, Neural Network, NetFlow

Digital Object Identifier (DOI)

https://doi.org/10.2298/CSIS130415035A

Publication information

Volume 11, Issue 2 (June 2014)
Year of Publication: 2014
ISSN: 1820-0214 (Print) 2406-1018 (Online)
Publisher: ComSIS Consortium

Full text

DownloadAvailable in PDF
Portable Document Format

How to cite

Abuadlla, Y., Kvascev, G., Gajin, S., Jovanovic, Z.: Flow-Based Anomaly Intrusion Detection System Using Two Neural Network Stages. Computer Science and Information Systems, Vol. 11, No. 2, 601-622. (2014)