Advertisement

Evolutionary Learning Program’s Behavior in Neural Networks for Anomaly Detection

  • Sang-Jun Han
  • Kyung-Joong Kim
  • Sung-Bae Cho
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3316)

Abstract

Learning program’s behavior using machine learning techniques based on system call audit data is effective to detect intrusions. Among several machine learning techniques, the neural networks are known for its good performance in learning system call sequences. However, it suffers from very long training time because there are no formal solutions for determining the suitable structure of networks. In this paper, a novel intrusion detection technique based on evolutionary neural networks is proposed. Evolutionary neural networks have the advantage that it takes shorter time to obtain superior neural network than the conventional approaches because they learn the structure and weights of neural network simultaneously. Experimental results against 1999 DARPA IDEVAL data confirm that evolutionary neural networks are promising for intrusion detection.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Yao, X.: Evolving Artificial Neural Networks. Proceedings of the IEEE 87(9), 1423–1447 (1999)CrossRefGoogle Scholar
  2. 2.
    Ghosh, A.K., Schwartzbard, A., Schatz, M.: Learning Program Behavior Profiles for Intrusion Detection. In: Proceedings of the 1st USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, CA, pp. 51–62 (April 1999)Google Scholar
  3. 3.
    Ghosh, A.K., Michael, C.C., Schatz, M.A.: A Real-Time Intrusion Detection System Based on Learning Program Behavior. In: Proceedings of the Third International Symposium on Recent Advances in Intrusion Detection, pp. 93–109 (2000)Google Scholar
  4. 4.
    MIT Lincoln Laboratory, DARPA Intrusion Detection Evaluation. Available from, http://www.ll.mit.edu/IST/ideval/index.html
  5. 5.
    Lippmann, R., Haines, J., Fried, D., Korba, J., Das, K.: The 1999 DARPA Off-Line Intrusion Detection Evaluation. Computer Networks 34(4), 579–595 (2000)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2004

Authors and Affiliations

  • Sang-Jun Han
    • 1
  • Kyung-Joong Kim
    • 1
  • Sung-Bae Cho
    • 1
  1. 1.Dept. of Computer ScienceYonsei UniversitySeoulKorea

Personalised recommendations