Evolutionary neural networks for anomaly detection based on the behavior of a program

The process of learning the behavior of a given program by using machine-learning techniques (based on system-call audit data) is effective to detect intrusions. Rule learning, neural networks, statistics, and hidden Markov models (HMMs) are some of the kinds of representative methods for intrusion...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on cybernetics 2006-06, Vol.36 (3), p.559-570
Main Authors: Han, Sang-Jun, Cho, Sung-Bae
Format: Article
Language:English
Subjects:
Algorithms
Anomaly detection
Artificial Intelligence
Biological Evolution
Computer Security
Cybernetics
Data security
Evolutionary
evolutionary algorithms
Evolutionary computation
Hidden Markov models
Information security
Intrusion
Intrusion detection
intrusion detection system (IDS)
Learning
Machine learning
Mathematical analysis
Mathematical models
Neural networks
Neural Networks (Computer)
Pattern matching
Pattern Recognition, Automated - methods
Software
Software Validation
Statistics
Studies
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The process of learning the behavior of a given program by using machine-learning techniques (based on system-call audit data) is effective to detect intrusions. Rule learning, neural networks, statistics, and hidden Markov models (HMMs) are some of the kinds of representative methods for intrusion detection. Among them, neural networks are known for good performance in learning system-call sequences. In order to apply this knowledge to real-world problems successfully, it is important to determine the structures and weights of these call sequences. However, finding the appropriate structures requires very long time periods because there are no suitable analytical solutions. In this paper, a novel intrusion-detection technique based on evolutionary neural networks (ENNs) is proposed. One advantage of using ENNs is that it takes less time to obtain superior neural networks than when using conventional approaches. This is because they discover the structures and weights of the neural networks simultaneously. Experimental results with the 1999 Defense Advanced Research Projects Agency (DARPA) Intrusion Detection Evaluation (IDEVAL) data confirm that ENNs are promising tools for intrusion detection.
ISSN:1083-4419
2168-2267
1941-0492
2168-2275
DOI:10.1109/TSMCB.2005.860136