Monitoring System Security Using Neural Networks and Support Vector Machines

Abstract

Information assurance is an issue of serious global concern. The complexity, accessibility, and openness of the Internet and the World Wide Web have all increased the risk of information system security. Further, vulnerability assessment indicates that future terrorist attacks may take place in the cyberspace to cause mass disruptions. Developing effective methods for preventing and detecting intrusions and misuses, therefore, will be essential for assuring the security of computer systems that are at the core of various controls in the modern society. This paper concerns intrusion detection, an important issue in defensive information warfare. We describe an intrusion detection system using neural networks, as well as using SVM (support vectors machines)—a hitherto untried approach in this field. Both methods carry out the detection of specific exploitations by comparing user activity (such as recorded in command logs) against (real and synthetic) attack patterns belonging to different categories of intrusion. The aim of our design of the intrusion detection system is to be general, adaptable, and effective. Testing results based on real-world intrusion data are also presented.