Detecting Anomalous Traffic Using Statistical Discriminator and Neural Decisional Motor
Detecting Anomalous Traffic Using Statistical Discriminator and Neural Decisional Motor
复制标题
使用统计鉴别器和神经决策电机检测异常流量
DOI：
10.1007/978-3-540-73053-8_37
复制
发表时间：
2007
期刊：
影响因子：
--
通讯作者：
P. Puliti
中科院分区：
文献类型：
--
作者：
P. Baldassarri;A. Montesanto;P. Puliti
信息安全的主要挑战之一是引入能够识别入侵的系统。在这个范围内，这项工作发生描述一个新的入侵检测系统的异常方法的基础上。我们实现了一个基于主机和基于网络的方法之间的混合解决方案的系统，它包括两个子系统：一个统计系统和一个神经系统。从网络流量中提取的特征只属于IP报头，它们的趋势允许我们通过简单的视觉检查来检测是否发生了攻击。实际上，双层神经系统必须指示系统的状态。它对被监控主机的流量进行分类，区分背景流量和异常流量。此外，一个非常重要的方面是，系统能够将同一攻击的不同实例分类到同一类中，从而确定发生了哪种攻击。
One of the main challenges in the information security concerns the introduction of systems able to identify intrusions. In this ambit this work takes place describing a new Intrusion Detection System based on anomaly approach. We realized a system with a hybrid solution between host-based and network-based approaches, and it consisted of two subsystems: a statistical system and a neural one. The features extracted from the network traffic belong only to the IP Header and their trend allows us detecting through a simple visual inspection if an attack occurred. Really the two-tier neural system has to indicate the status of the system. It classifies the traffic of the monitored host, distinguishing the background traffic from the anomalous one. Besides, a very important aspect is that the system is able to classify different instances of the same attack in the same class, establishing which attack occurs.