A Hierarchical Anomaly Network Intrusion Detection System using Neural Network Classification

In this paper, we introduce a hierarchical anomaly network intrusion detection system, which is capable of detecting network–based attacks using statistical preprocessing models and neural network classification. The sample network used has a three-tier hierarchy, where the lower tier detectors report to the higher tiers. The statistical preprocessor converts network traffic sample information into a PDF that is compared to a historically developed PDF for corresponding normal network traffic, thus deriving a statistical similarity decision vector that the neural network classifies into anomalous (attack) or normal instance. Several simulation experiments have been carried out focusing on the Denial of Service attack. We used the Perceptron-Backpropagation-Hybrid (PBH) as the neural net classifier, which showed fast convergence (only a few epochs needed) and a small number of weights. The classification results are characterized by low misclassification error rates, for both false positives and false negatives. Key-Words: Security, Intrusion Detection, Statistical Preprocessing, Neural Network Classification, PerceptronBackpropagation-Hybrid, PBH, Anomaly Detection