Evolutionary Learning Program’s Behavior in Neural Networks for Anomaly Detection
Learning program’s behavior using machine learning techniques based on system call audit data is effective to detect intrusions. Among several machine learning techniques, the neural networks are known for its good performance in learning system call sequences. However, it suffers from very long training time because there are no formal solutions for determining the suitable structure of networks. In this paper, a novel intrusion detection technique based on evolutionary neural networks is proposed. Evolutionary neural networks have the advantage that it takes shorter time to obtain superior neural network than the conventional approaches because they learn the structure and weights of neural network simultaneously. Experimental results against 1999 DARPA IDEVAL data confirm that evolutionary neural networks are promising for intrusion detection.
Unable to display preview. Download preview PDF.
- 2.Ghosh, A.K., Schwartzbard, A., Schatz, M.: Learning Program Behavior Profiles for Intrusion Detection. In: Proceedings of the 1st USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, CA, pp. 51–62 (April 1999)Google Scholar
- 3.Ghosh, A.K., Michael, C.C., Schatz, M.A.: A Real-Time Intrusion Detection System Based on Learning Program Behavior. In: Proceedings of the Third International Symposium on Recent Advances in Intrusion Detection, pp. 93–109 (2000)Google Scholar
- 4.MIT Lincoln Laboratory, DARPA Intrusion Detection Evaluation. Available from, http://www.ll.mit.edu/IST/ideval/index.html