Applying Neural Networks to Anomaly Dectection

Nov 21, 1997

Abstract

A distinction between anomaly and misuse detection has emerged in the recent past. Where misuse detection mechanisms encapsulate and detect known, previously encountered security violations, anomaly detection mechanisms address the problem from a different angle. Based on the on the hypothesis that security violations involve abnormal usage of a system resources, it aims to detect security violations by identifying abnormal patterns of system usage. In particular it addresses that area of security violations where which arise from possible flaws or vulnerabilities that may not have been anticipated or previously known.

My doctoral thesis involves the application of an adaptive neural engine towards encapsulating subject behaviour from directly available system information. More precisely it concentrates on the effectiveness of the neural mechanism to define normal behaviour, flag abnormal behaviour and reporting true alarms and true acceptances as opposed to false alarms and false acceptances.

The research work undertaken in conjunction with the Australian Federal Police involves the use of the same neural engine applied to the examination of network traffic captured using readily available network monitoring software. The study attempts to characterise and classify standard TCP/IP network services with the view to developing signatures for each connection type for a particular network environment. Network traffic can then be correlated with these signatures and anomalous network activities, such as intruder installed network services, detected. The preliminary results of this research are to be presented in a paper at the 13th Annual Computer Security Applications Conference in San Diego in December 1997.