Designing Intrusion Detection System for Web Documents Using Neural Network

Hari Om, Tapas K. Sarkar

.

DOI: 10.4236/cn.2010.21008                

Abstract

Cryptographic systems are the most widely used techniques for information security. These systems however have their own pitfalls as they rely on prevention as their sole means of defense. That is why most of the organizations are attracted to the intrusion detection systems. The intrusion detection systems can be broadly categorized into two types, Anomaly and Misuse Detection systems. An anomaly-based system detects com-puter intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. Misuse detection systems can detect almost all known attack patterns; they however are hardly of any use to de-tect yet unknown attacks. In this paper, we use Neural Networks for detecting intrusive web documents avail-able on Internet. For this purpose Back Propagation Neural (BPN) Network architecture is applied that is one of the most popular network architectures for supervised learning. Analysis is carried out on Internet Security and Acceleration (ISA) server 2000 log for finding out the web documents that should not be accessed by the unau-thorized persons in an organization. There are lots of web documents available online on Internet that may be harmful for an organization. Most of these documents are blocked for use, but still users of the organization try to access these documents and may cause problem in the organization network.

Keywords

intrusion detection system, neural network, back propagation network, anomaly detection, misuse detection

Conflicts of Interest

The authors declare no conflicts of interest.

References

[1]	R. J. Anderson, “Why cryptosystems fail,” In Communications of the ACM, Vol. 37, No. 11, pp. 32–40, November 1994.
[2]	http://www.cert.org/reports/dsit_ workshop-final.html.
[3]	H. Varian, “Managing online security risks,” Economic Science Column, The New York Times, June 2000.
[4]	SANS Institute staff, “Intrusion detection and vulnerability testing tools: what works?” 101 Security Solutions E-Alert Newsletters, 2001.
[5]	T. K. Kim, D. Y. Lee, and T. M. Chung, “Mobile agent- based misuse intrusion detection rule propagation model for distributed system,” Lecture Note in Computer Science, Vol. 2510, pp. 842–849, 2002.
[6]	O. Depren, M. Topallar, E. Anarim, and M. K. Ciliz, “An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks,” Expert Systems with Applications, Vol. 29, No. 4, pp. 713–722, November 2005.
[7]	T. Konno and M. Tateoka, “Accuracy improvement of anomaly-based intrusion detection system using taguchi method,” Proceeding of Symposium on Applications and the Internet Workshops (SAINT-W’05), 0-7695-2263- 7/05, 2005.
[8]	K. Ilgun, “USTAT: A real-time intrusion detection system for UNIX,” Proceeding of the 1993 Computer Society Symposium on Research in Security and Privacy, Oakland, California, Los Alamitos, pp. 16–28, May 1993.
[9]	K. Fox, R. Henning, J. Reed, and R. Simonian, “A neural network approach towards intrusion detection,” Proceeding of 13th National Computer Security Conference, Baltimore, MD, pp. 125–134, 1990.
[10]	J. Frank, “Artificial intelligence and intrusion detection: current and future directions,” Computers and Security, Vol. 14, No. 1, pp. 31–31(1), 1995.
[11]	L. Fu, “A neural network model for learning rule-based systems,” Proceeding of the International Joint Conference on Neural Networks, pp. 343–348, 1992.
[12]	D. Hammerstrom, “Neural networks at work,” IEEE Spectrum, pp. 26–53, June 1993.
[13]	J. Zimmermann, L. Mé, and C. Bidan, “An improved reference flow control model for policy-based intrusion detection,” Proceeding of the 8th European Symposium on Research in Computer Security (ESORICS), pp. 291– 308, October 2003.
[14]	G. J. Nalepa, “Application of the XTT rule-based model for formal design and verification of internet security systems,” Lecture Notes in Computer Science, Vol. 4680, pp. 81–86, 2007.
[15]	D. Dorothy, “An intrusion-detection model,” IEEE Trans- actions on Software Engineering, Vol. 13, No. 2, pp. 222– 232, February 1987.
[16]	M. M. Sebring, E. Shellhouse, M. E. Hanna, and R. A. Whitehurst, “Expert systems in intrusion detection: a case study,” Proceeding of the 11th National Computer Security Conference, Baltimore, MD, pp. 74–81, October 1988.
[17]	S. Staniford-Chen, S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee, R. Yip, and D. Zerkle. “GrIDS, a graph based intrusion detection system for large networks,” Proceeding of the 20th National Information Systems Security Conference, Vol. 1, pp. 361– 370, October 1996.
[18]	P. A. Porras and P. G. Neumann, “Emerald: event monitoring enabling responses to anomalous live disturbances,” Proceeding of the 20th National Information systems Security Conference, pp. 35–365, October 1997.
[19]	S. Freeman, “Host based intrusion detection using user signatures,” Computer Science Master’s project, May 2002.
[20]	A. K. Ghosh, A. Schwartzbard, and M. Schatz, “Learning program behavior profiles for intrusion detection,” Proceeding of the 1st Workshop on Intrusion Detection and Network Monitoring, pp. 51–62, April 1999.
[21]	A. ¨Oks¨uz, “Unsupervised intrusion detection system,” Master Thesis, Technical University of Denmark, 2007.
[22]	A. Boukerche, K. R. Lemos Juc, J. B. Sobral, and M. Sechi Moretti Annoni Notare, “An artificial immune based intrusion detection model for computer and telecommunication systems,” Parallel Computing, Vol. 30, No. 5–6, pp. 629–646, 2004.
[23]	R. Beghdad, “Modelling and solving the intrusion detection problem in computer networks,” Computers and Security, Vol. 23, No. 8, pp. 687–696, 2004.
[24]	T. F. Lunt and R. Jagannathan, “A prototype real-time intrusion-detection system,” Proceeding of the Symposium on Security and Privacy, New York, pp. 59–66, April 1988.
[25]	T. D. Garvey and T. F. Lunt, “Model based intrusion detection,” Proceeding of the 14th National Computer Security Conference, pp. 372–385, October 1991.
[26]	K. Ilgun, “Ustat: A real-time intrusion detection system for UNIX,” Master’s thesis, Computer Science Dept, UCSB, July 1992.
[27]	S. Kumar and E. H. Spafford, “A pattern matching model for misuse intrusion detection,” The COAST Project, Purdue University, 1996.
[28]	J. Ryan, M. Lin, and R. Miikkulainen, “Intrusion Detection with Neural Networks,” AI Approaches to Fraud Detection and Risk Management: Papers from the 1997 AAAI Workshop (Providence, Rhode Island), pp. 72–79, 1997.
[29]	H. Debar and B. Dorizzi, “An application of a recurrent network to an intrusion detection system,” Proceeding of the International Joint Conference on Neural Networks, pp. 478–483, 1992.
[30]	A. Abraham, C. Grosan, and C. Martin-Vide, “Evolutionary design of intrusion detection programs,” International Journal of Network Security, Vol. 4, No. 3, pp. 328–339, March 2007.
[31]	M. Denault, D. Gritzalis, D. Karagiannis, and P. Spirakis, “Intrusion detection: approach and performance issues of the securenet system,” Computers and Security, Vol. 13, No. 6, pp. 495–500, 1994.
[32]	S. E. Smaha, “Haystack: an intrusion detection system,” Proceeding of the Fourth AeroSpace Computer Security Applications Conference, Orlando, FL, pp. 37–44, December 1988.