A study in using neural networks for anomaly and misuse detection

TLDR

Current intrusion detection systems cannot generalize from observed attacks to detect slight variations of known attacks. This paper proposes process‑based intrusion detection approaches that generalize from observed behavior to recognize future unseen behavior. The authors employ artificial neural networks to perform both anomaly and misuse detection, applying these techniques to a large DARPA‑sponsored dataset from Lincoln Labs at MIT. The methods produced results on the DARPA evaluation data for both anomaly and misuse detection.

Abstract

Current intrusion detection systems lack the ability to generalize from previously observed attacks to detect even slight variations of known attacks. This paper describes new process-based intrusion detection approaches that provide the ability to generalize from previously observed behavior to recognize future unseen behavior. The approach employs artificial neural networks (ANNs), and can be used for both anomaly detection in order to detect novel attacks and misuse detection in order to detect known attacks and even variations of known attacks. These techniques were applied to a large corpus of data collected by Lincoln Labs at MIT for an intrusion detection system evaluation sponsored by the U.S. Defense Advanced Research Projects Agency (DARPA). Results from applying these techniques for both anomaly and misuse detection against the DARPA evaluation data are presented.