Artificial neural network for misuse detection
Download as PPT, PDF1 like950 views
Manoj Kumar Gantayat presented on using artificial neural networks for intrusion detection. He discussed how neural networks can be applied to misuse detection in intrusion detection systems. Specifically, he covered three neural network models (Perceptron, Backpropagation, hybrid), components of intrusion detection systems, advantages of neural networks in analyzing incomplete or distorted data, and challenges like needing accurate training data. He concluded the early results of neural network intrusion detection systems show promise for refinement and full-scale demonstration systems.
Artificial neural network for misuse detection
- 1. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 ARTIFICIAL NEURAL NETWORK FOR MISUSE DETECTION by MANOJ KUMAR GANTAYAT ([email protected]) Roll # CS200117145 Under the Guidance of MR. S.K.MEHER
- 2. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 INTRODUCTION INTRUSION DETECTION SYSTEMS (IDS) • Host-based IDS • Network-based IDS • Vulnerability-assessment IDS COMPONENT OF Of IDS • An information source that provides a stream of event records • An analysis engine that identifies signs of intrusions • A response component that gene rates reactions based on the outcome of the analysis engine.
- 3. NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 Technical Seminar Presentation - 2004 NEURAL NETWORKS
- 4. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 NEURAL NETWORK IDS PROTOTYPES 1. Percetron Model: A single neuron with adjustable synapses and threshold.
- 5. Technical Seminar Presentation - 2004 2. Backpropagation Model NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 3. Perceptron-Backpropagation Hybrid Model
- 6. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 Neural Network Intrusion Detection Systems • Computer attack • Typical characteristics of User • Computer Viruses • Malicious Software in Computer Network
- 7. NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 Technical Seminar Presentation - 2004 NEGPAIM MODEL
- 8. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 NEURAL ENGINE • Based Anomaly intrusion detection • Establish profiles of normal user and compare user behaviors to those profiles • Investigation of total behaviors of the user Disadvantages • A statistical assumption is required
- 9. Technical Seminar Presentation - 2004 IMPLEMENTATION NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 • Uses Multi-layer Pecptron Network First Stage : 1. Training a set of historical Data 2. Only once for each user Second Stage: 1. Engine accept input Data 2. Compare with the historical Data
- 10. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 IMPLEMENTATION OF ANN 1. Incorporating into Modified or Existing Expert system • The incoming Data is Filtered by Neural Network for suspicious event • The False alarm should be reduced Disadvantages: • Need for update to recognize the new attack
- 11. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 2. Neural Network as Stand alone System • Data is received from Network Stream and analyzed for misuse • Indicative of data is forwarded to automated intrusion response system
- 12. Technical Seminar Presentation - 2004 LEVEL OF PROCESSING OF DATA NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 LEVEL 1: The element of data is selected from packet as Protocol ID, Source Port, Destination Port, Source Address, Destination Address, ICMP type, ICMP Code, Raw data length, Raw. LEVEEL 2: Converting the nine element data to a standardized numeric representation. LEVEL 3: Conversion of result data into ASCII coma delimited format that could be used by Neural Network.
- 13. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 ADVANTAGES OF ANN BASED MISUSE DETECTION • Analyzing the Data which is incomplete of distorted • Speed of neural Network • A particular event was indicative attack can be known • To Learn the characteristics of Misuse attack
- 14. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 DISADVANTAGES OF ANN BASED MISUSE DETECTION • Need accurate training of the system • Black Box nature of the neural network • The weight and transfer function of various network nodes are Frozen after a network has achieved a level of success in identification of event
- 15. Technical Seminar Presentation - 2004 NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 CONCLUSION The early results of tests of these technologies show significant promise, and our future work will involve the refinement of the approach and the development of a full-scale demonstration system
- 16. NATIONAL INSTITUTE OF SCIENCE & TECHNOLOGY Presented by:Manoj Kumar Gantayat CS:200118258 Technical Seminar Presentation - 2004 THANK YOU