Intrusion Detection Based on Normal Traffic Specifications

• Published in: International journal of computer network and information security 2015-08, Vol.7 (9), p.32-38
• Main Authors: Heidarian, Zeinab, Movahedinia, Naser, Moghim, Neda, Mahdinia, Payam
• Format: Article
• Language: English
• ISSN: 2074-9090; 2074-9104
• DOI: 10.5815/ijcnis.2015.09.04

As intrusion detection techniques based on malicious traffic signature are unable to detect unknown attacks, the methods derived from characterizing the behavior of the normal traffic are appropriate in case of detecting unseen intrusions. Based on such a technique, one class Support Vector Machine (SVM) is employed in this research to learn http regular traffic characteristics for anomaly detection. First, suitable features are extracted from the normal and abnormal http traffic; then the system is trained by the normal traffic samples. To detect anomaly, the actual traffic (including normal and abnormal packets) is compared to the deduced normal traffic. An anomaly alert is generated if any deviation from the regular traffic model is inferred. Examining the performance of the proposed algorithm using ISCX data set has delivered high accuracy of 89.25% and low false positive of 8.60% in detecting attacks on port 80. In this research, online step speed has reached to 77 times faster than CPU using GPU for feature extraction and OpenMp for parallel processing of packets.