The rapid expansion of computer networks makes security issues among computer systems one of the most important. Intrusion detection systems are using artificial intelligence more and more. This article discusses intrusion detection. Multi-layer perceptron (MLP) is used to detect offline intrusion attacks. The work uses the issues of determining the type of attack. Various neural network structures are considered to detect the optimal neural network by the number of input neurons and the number of hidden layers. It has also been investigated that activation functions and their influence on increasing the ability to generalize a neural network. The results show that the neural network is a 15x31x1 way to classify records with an accuracy of about 99% for known types of attacks, with an accuracy of 97% for normal vectors and 34% for unknown types of attacks.
Currently, information technology has penetrated practically all spheres of life of modern society. And an integral part of information technology is the Internet. The reason for such an intensive development of information technology is the growing need for quick and high-quality processing of information, the instantaneous transmission of information to various parts of the world. In this regard, one of the main tasks is to ensure the security of information that is transmitted or processed on the network, protection against network attacks.
At the moment, complex information security systems are becoming increasingly important. As components of such system act as antivirus protection systems, integrity monitoring systems, firewalls, vulnerability analysis, detection and prevention systems, etc. Intrusion Detection and Intrusion Detection Systems, or, as they are called, the means of detecting attacks, is precisely this mechanism of protection of the network, which is assigned the functions of protection against network attacks.
There is a large number of methods for
detecting network attacks, but as attacks
constantly change special databases with rules or
signatures to detect attacks requiring continuous
administration, there is a need to add new rules.
One of the ways to eliminate this problem is to use
the neural network as a mechanism for detecting
network attacks. Unlike the signature approach,
the neural network performs an analysis of
information and provides information about the
attacks that it is trained to recognize. In addition,
neural networks have the advantage - they are able
to adapt to previously unknown attacks and detect
them [
Detecting network attacks is a process of
recognizing and responding to suspicious activity
directed to the network or computing resources of
an organization [
Behavioral methods are called methods based
on the use of information about the normal
behavior of the system and its comparison with
the parameters of observable behavior [
Statistical analysis is the core of methods for
detecting anomalies in the network. At the very
beginning of this method, profiles are defined for
each subject of the analyzed system. Any
deviation of the profile used from the reference is
considered to be unauthorized activity. [
It should be noted that in the statistical systems an important role is played by the correct choice of controlled parameters that characterize the differences in normal and abnormal traffic. It may turn out that due to the wrong choice of the number of observed parameters, the model describing the behavior of entities in the system will be incomplete or excessive. This results in the passage of attacks or false alarms in the system.
The advantages of statistical systems are their adaptation to change the behavior of the user, as well as the ability to detect the modifications of the attack. Among the shortcomings
it is possible to note the high probability of occurrence of false reports of attacks, as well as their pass.
Knowledge-based methods include such
methods, which in the context of the given facts,
rules of output and comparison, reflect the signs
of given attacks, produce actions to detect attacks
based on the found mechanism of search [
In signature methods, system events are
presented in the form of strings of characters from
a certain alphabet. The essence of these methods
is to set the set of attack signatures in the form of
regular expressions or patterns based on model
matching and verify the match of the observed
events with these expressions. Signature is a set of
attributes that can distinguish network attacks
from other types of network traffic. In the input
package, the byte is viewed by byte and compared
to the signature (signature) - a characteristic line
of the program, indicating the characteristics of
malicious traffic. Such a signature may contain a
key phrase or a command that is associated with
an attack. If a match is found, an alarm is
announced [
The main advantage of the signature method is that the detection of known samples of abnormal events is carried out as effectively as possible. But at the same time, the use of a signature database of a large volume negatively affects the performance of the detection system. The disadvantage of this method is the impossibility of detecting attacks whose signature has not yet been determined.
Methods of computing intelligence. This
category includes neural networks. The neural
network is a set of processing elements - neurons,
interconnected by synapses, which convert the set
of input values into a set of desired output values
[
There are several methods for training neural
networks. One of the most well-known and most
widely used learning algorithms for multilayer
neural networks is the direct dissemination of the
method of reverse error propagation [
One of the important advantages of neural
networks is their ability to take into account the
characteristics of attacks, identifying elements
that are not similar to those studied [
Neural networks are one of the areas of
research in the field of artificial intelligence,
based on attempts to recreate the human nervous
system, namely the ability of the nervous system
to learn and correct mistakes that should enable
the work of the human brain to be simulated,
albeit roughly, [
4. The activation function of the neuron F(x).
There are many properties in the neural network, but the most important is its ability to learn. The process of training the network reduced to the change in weight coefficients. (1) = ∑
The multilayer neural network includes input, output and hidden layers (Figure 2).
Input layer - serves to distribute data over the network and does not do any calculations. Outputs of this layer transmit signals to the inputs of the next layer (hidden or output).
Hidden layers are layers of normal neurons that process data obtained from the previous layer and transmit signals from the input to the output. Their input is the output of the previous layer, and the output is the input of the next layer.
Output layer - usually contains one neuron
(maybe
more),
which
gives
the
result of
calculations of the entire neural network. [
To conduct research, it was decided to use the NSL-KDD attack database. This database is based on the basis of the KDD-99 on the initiative of the
It covers a wide range of different intrusions. Data is a text file. This file contained both normal vectors and an abnormal activity vector.
Abnormal activity is marked by an attack type. All attacks in NSL-KDD are divided into four groups: DoS (Denial of Service Attack), U2R (Users to Root Attack), R2L (Remote to Local Attack) and Probe (Probing Attack). Table 1 lists the types of attacks, their number and the class to which the attack belongs.
Each record has 42 attributes describing different attributes (table 2).
The Deductor Academic 5.3 software to construct and test the neural network was used. Deductor is a platform for creating complete analytical solutions. The platform employs advanced methods for extracting, rendering data and analyzing data. Deductor Academic - The free version for educational purposes only intended.
In this paper, the study for attacks like DoS conducted. Therefore, a parser written to extract the necessary vectors. There were 4 files for training and testing of the neural network: KDDTrainDos + .txt, KDDTestDefinedDos + .txt, KDDTestNormalDos + .txt, KDDTestUndefinedDos + .txt. The files contain a set of training data, a set of known attacks and normal vectors that listed in the training set, as well as a set of unknown attacks.
The file for training the neural network contains 7,000 records, the contents of the file given in Table 3.
A test file with known attack types contains 5000 entries. The table of contents given in Table 4.
A normal testing file contains 781 entries. The file with unknown types of attacks are attacks such land and pod, the number of entries is 219. Research of intrusion detection was performed using multilayer perceptron.
Before the construction of the neural network training data set excluded parameters have the same meaning throughout the sample. This was done to accelerate results.
The first neural network was built on 28 parameters. It consisted of an input, one hidden and output layers. The input and hidden layer neurons had 28 each, consisting of one output neuron containing conclude attack (1 - attack, 0 normal traffic). This neural network is presented in Figure 3.
After building a neural network was conducted three tests to assess the quality of its work in detecting attacks. The first test was carried out for attacks from known types for neural network (back, neptune, smurf, teardrop). Neural network with almost 100% (99.78%) accurately recognizes known types of attacks. Further testing was conducted for normal traffic. In this case, the results were similar to results for known types of attacks (98.98%). And the last test was performed with unknown types of attacks for the neural network, namely attacks like land and pod.
Unlike previous tests, the result is very different. That is, in this case, we can say that only every 4th attack will be detected. But it should be noted that since these types of attacks were not present in the training set, we can say that this is a good result. And also the knowledge that such methods as statistical analysis and the method of signature analysis, in the absence of information about the attack data in general, would mark them as normal traffic suggests that the use of neural networks to detect intrusions is justified, since they have the ability to adapt to unknown attacks.
Since satisfactory results were obtained, a decision was made to construct neural networks with different parameters to determine the optimal configuration for detecting the maximum number of attacks. Changes were made in the number of input parameters, in the change of activation function and its steepness, and in the number of hidden layers.
The following neural networks have a common configuration: 15 input neurons, 16 neurons in the hidden layer and 1 output neuron (Figure 4).
All neural networks 15x16x1 have the same look, the difference between them is only in different activation functions and the value of the slope parameter (Table 5).
For each of the networks built previously described tests were conducted, such as intrusion detection with known types, normal traffic and attacks with unknown types. The results obtained with the use of these neural networks are presented in Table 6.
Based on the results, we can say that the best of all has shown itself the function of activation of the sigmoid. The artagens and the hypertension, however, did not give satisfactory results, although the recognition of attacks with an unknown type has increased significantly, the quality of the definition of normal traffic has suffered greatly. Therefore, in this case, we can conclude that for this task, the function of activating the sigmoid is better suited. Regarding the slope coefficient, we can say that the coefficient 1.5 did not improve the results. Therefore, the following studies were conducted with sigmoid and factor 1, since the best results were obtained for this configuration. Further changes relate only to the number of neurons and the number of hidden layers.
Next, neuronal networks with 21, 26 and 31 neurons were constructed on a hidden layer.
Further tests were carried out. The results are presented in Table 7.
The last two experiments were conducted with a neural network with two hidden layers (Figure 5) and a neural network with a smaller number of input neurons - 10 (Figure 6).
Detection Detection Detecting of known of normal Unknown attacks,% vectors,% Attacks,%
From the results it can be seen that the neural network with 10 input neurons has worse results than neural networks with more input parameters. Thus, a strong reduction in the number of input parameters has a negative effect on the result. As for a neural network with two hidden layers, it has approximately the same results as the neural networks 15x16x1 and 15x31x1. If you summarize the value (to sum up the percentage and find it divided by the number of experimentation findings) for networks with better results, namely for 15x16x1, 15x31x1 and 15x15x15x1, then you can see which neural network has better coped with the task (table 9).
Among the considered neural networks, the best with the task of detecting attacks was copied neural network with 31 neurons in the hidden layer.
So, as can be seen in comparison with the first experiment, where the percentage of unknown attacks was 27.4% managed to get an increase to 34%, that is, every third unknown attack would be detected.
Thus, we can conclude that although the percentage is not very large, it is satisfactory, as it is much better than skipping attacks as normal traffic. It can be said that the use of multilayer perceptron for this task is justified.