PaperlayerView exact revision on arXiv

Source-linked AI summary

A hybrid artificial immune system and Self Organising Map for network intrusion detection

Simon T. Powers, Jun He

arXiv:1208.0541v1cs.NEcs.CR

TL;DR

Network intrusion detection must identify unauthorized access, while anomaly-detection systems can produce false positives and low-level alerts. This paper combines artificial-immune-system anomaly detection with SOM-based attack classification. On KDD 1999 Cup, the authors report favorable false-positive and attack-classification results compared with a sample of other works.

  • Problem

    Anomaly detection can produce false positives, and anomaly-detection systems typically provide only low-level output rather than attack context.

    Source: §1.1 · p. 3, §5 · p. 27

  • Method

    The hybrid IDS uses an artificial immune system to detect anomalous connections and a Kohonen SOM to classify flagged connections into broad attack types.

    Source: §1 · p. 2

  • Results

    The authors report favorable false-positive and attack-classification results compared with a sample of other works on the KDD 1999 Cup dataset.

    Source: §5 · p. 27

  • Takeaways & Limitations

    The system provides broad attack-type information about detected anomalies, beyond the low-level output typical of anomaly-detection systems.

    Source: §5 · pp. 26–27

    Direct performance comparisons are difficult because the other works calculate performance differently.

    Source: §4.5 · p. 25

Abstract

from arXiv · show

Network intrusion detection is the problem of detecting unauthorised use of, or access to, computer systems over a network. Two broad approaches exist to tackle this problem: anomaly detection and misuse detection. An anomaly detection system is trained only on examples of normal connections, and thus has the potential to detect novel attacks. However, many anomaly detection systems simply report the anomalous activity, rather than analysing it further in order to report higher-level information that is of more use to a security officer. On the other hand, misuse detection systems recognise known attack patterns, thereby allowing them to provide more detailed information about an intrusion. However, such systems cannot detect novel attacks. A hybrid system is presented in this paper with the aim of combining the advantages of both approaches. Specifically, anomalous network connections are initially detected using an artificial immune system. Connections that are flagged as anomalous are then categorised using a Kohonen Self Organising Map, allowing higher-level information, in the form of cluster membership, to be extracted. Experimental results on the KDD 1999 Cup dataset show a low false positive rate and a detection and classification rate for Denial-of-Service and User-to-Root attacks that is higher than those in a sample of other works.

1 Introduction

Anomaly detection can identify novel attacks but often produces false positives and low-level alerts that leave security officers without useful attack context. The paper combines anomaly detection with attack clustering, so anomalous connections can be assigned a broad attack type.

1 Introduction

  • The hybrid IDS first uses an artificial immune system to detect anomalous TCP/UDP connections, then uses a Kohonen SOM to classify them into broad attack types.The stages are separate: anomaly detectors use normal-connection examples, while the SOM is trained on attack connections to group attacks by shared properties.Source: §1 · p. 2, §1.3 · p. 5

1.1 Motivation for a two-stage approach to intrusion detection

  • Anomaly detection can identify novel attacks, but false positives and low-level alerts make standalone systems difficult to use in practice.False positives can waste security officers’ time and undermine confidence; low-level alerts can also be tedious to process.Source: §1.1 · pp. 3–4

1.2 Contributions of this paper

  • The paper’s contribution is to derive higher-level information from anomalies by clustering attacks with shared properties and matching new anomalies to those clusters.Cluster centres represent common properties of attacks; the resulting information is intended to help security officers understand possible attack consequences and actions.Source: §1 · p. 2, §1.2 · p. 4, §1.1 · p. 4

1.3 Overview of our novel hybrid IDS

  • At runtime, connection vectors undergo negative-selection anomaly detection, and flagged vectors are projected onto a SOM neuron associated with similar attacks.The SOM projection highlights shared attack properties and supplies higher-level information about the anomaly.Source: §1.3 · p. 5

2 Anomaly Detection Using an Artificial Immune System

The paper extends negative-selection anomaly detection to discrete network-connection fields using interpretable detectors and a genetic generation procedure. Detectors balance broad non-self coverage against matching normal examples, while the SOM component is outside this section’s focus.

2.2.1 Detector Representation

  • The detector representation handles discrete fields by specifying values or intervals, with fields optionally left unspecified to increase coverage.Clustering field values reduces the search space and lets a detector cover a larger antigen-space region, at the cost of distinguishing individual values.Source: §2.1 · p. 9, §2.2.1 · pp. 9–10

2.2.2 Detector-antigen matching rule

  • A detector matches a connection when all its specified fields match, using equality for discrete fields and inclusive bounds for interval fields.Source: §2.2.2 · p. 10

2.2.3 Detector Generation

  • A steady-state genetic algorithm with deterministic crowding generates discrete-field detectors, and a final filter discards any detector matching a normal training connection.The weighted-ratio approach seeks compromise solutions between the objectives; the final filtering step reduces false positives.Source: §2.2.3 · pp. 11–13
  • Detectors are generated using only normal connections, avoiding bias toward recognizing only variants of known attacks.The genetic algorithm uses deterministic crowding to search for detectors covering different parts of non-self space.Source: §2.2.3 · p. 11
  • Detector generation balances generality against minimizing matches to self samples, trading potential attack coverage against false positives.Generality measures specified interval ranges and unspecified non-interval fields; the second objective minimizes matched normal training samples.Source: §2.2.3 · p. 11

3 Deriving Higher-level Information About Anomalies Using a Self Organising Map

The SOM organizes anomalous connection vectors by similarity, then assigns attack-class labels to its neurons; LVQ further adjusts the map using labelled examples. The paper motivates this approach with the map’s visual transparency and flexibility for representing attack details.

3.1 Creating a SOM of attack connection vectors

  • Training uses attack connection vectors without normal examples or attack labels, so the SOM discovers clusters independently of the separate anomaly-detection stage.The anomaly detectors decide whether connections are normal; the SOM processes connections already flagged as anomalous.Source: §3.1 · pp. 13–14
  • The SOM projects an anomalous connection vector onto the neuron whose weight vector is closest in Euclidean distance, while training maps nearby vectors to nearby grid neurons.Training also aims for low mean quantisation error, the average distance between each training vector and its winning neuron's weight vector.Source: §3.1 · p. 14

3.1.1 Extracting Cluster Information through Labelling the SOM

  • After unsupervised training, neurons are labelled with the most frequent attack class among training vectors projected onto them, so new vectors inherit their winning neuron's class.The paper uses four broad MIT Lincoln Labs classes: DoS, Probe, R2L, and U2R; these classes convey attack goals and likely means.Source: §3.1.1 · pp. 16–17

3.1.2 Improving Attack Classification Performance Using Learning Vector Quantisation

  • LVQ moves a winning neuron's weight toward correctly classified training vectors and away from misclassified ones, aiming to reduce training-set misclassifications.LVQ is supervised and follows the SOM's initial unsupervised training; the authors describe their IDS as the first SOM-based IDS, to their knowledge, to use LVQ.Source: §3.1.2 · pp. 17–18

3.2 Motivation for using a SOM for attack type classification

  • Compared with a black-box multilayer perceptron, the SOM can be visualized with class labels; its unsupervised training can also support finer-grained attack examples than the four convenient test classes.The paper suggests showing details of training attacks mapped to a neuron's region to help officers infer properties of a new anomalous connection.Source: §3.2 · pp. 18–19

4 Results

The experiments use the corrected 10% KDD 1999 Cup dataset, which contains preprocessed connection records with 41 features. The original training and testing partition is retained for comparison with existing systems.

4 Results

  • The experiments evaluate the hybrid system on the corrected 10% KDD 1999 Cup dataset, whose preprocessed connection records contain 41 features.The paper does not address preprocessing raw network traffic because the dataset is already preprocessed.Source: §4 · p. 19

4.2 Dataset description

  • The dataset provides separate training and testing sets containing normal, DoS, Probe, U2R, and R2L connections.The supplied passages give approximate class counts for each split but do not report experimental outcomes.Source: §4.2 · pp. 19–20
  • The authors retain the dataset's supplied training and testing partition to facilitate comparison with existing systems.Source: §4.2 · p. 20

4.3 Anomaly Detection Performance

Across objective-weight settings, the AIS false positive rate never exceeds 0.6%, while increasing obj1 generally improves anomalous-connection detection. The AIS itself labels connections only as normal or anomalous, though results are broken down by attack class.

4.3 Anomaly Detection Performance

  • The AIS classifies each connection only as normal or anomalous; attack-class breakdowns show its detection performance across attack types, not its classification of those types.Source: §4.3 · p. 20
  • The AIS false positive rate never exceeds 0.6% across the objective-weight settings.The authors attribute this in part to destroying detectors that still match normal training vectors; Table 2 presents AIS anomaly-detection performance on the corrected KDD99 test set.Source: §4.3 · p. 20, Table 2 · p. 21
  • Increasing obj1 generally improves anomalous-connection detection, while settings above 0.5 show no substantial performance difference.obj1 minimizes the number of conditions in detector matching rules.Source: §4.3 · pp. 20–21

4.4 Classification of Detected Attacks

The SOM classifies connections already detected as anomalous into one of four attack types. The experiments vary the output-grid size and report results averaged over two runs.

4.4 Classification of Detected Attacks

  • The SOM's classification task is to assign an already-detected anomalous connection to one of four attack types, not to distinguish normal from anomalous traffic.Source: §4.4 · p. 21
  • The SOM experiments use a square output grid, 2,000 training epochs, η0 = 0.1, and an initial neighbourhood width equal to the grid's side length.Source: §4.4 · p. 21

4.4.1 Varying the Size of the Output Grid

  • The output-grid-size comparison is averaged over two runs; the authors say few repeats are needed because initialization is the only stochastic element and poor maps can be identified by topological defects.They also state the training algorithm is relatively insensitive to weight-vector initialization.Source: §4.4.1 · p. 22

Probe

The 10-by-10 SOM is the reported best compromise across attack classes, while larger grids improve U2R classification at the expense of R2L. The section also describes an experiment applying LVQ after SOM training.

Probe

  • The 10-by-10 grid is the best compromise: it outperforms 7-by-7 on every class except DoS, where the difference is 0.33%, while 5-by-5 scores 0% on U2R.Table 3 reports attack-classification performance by SOM size on the test set.Source: Table 3 · p. 22, Probe · p. 23
  • The 5-by-5 SOM correctly classifies 99.13% of DoS, 96.32% of Probe, and 99.83% of R2L attacks, but misclassifies U2R attacks as R2L.No neurons were labelled as U2R in the 5-by-5 grid.Source: Probe · p. 22
  • At 10-by-10, U2R classification reaches 55.76%, while R2L performance is close to 35%.The corresponding U2R score for a 7-by-7 grid is 28.95%.Source: Probe · p. 22
  • Figure 3 marks Probe neurons with circles, DoS with plus signs, R2L with triangles, and U2R with x’s.It shows the labelled output grid for a trained 10-by-10 SOM.Source: Figure 3 · p. 23

4.4.2 Testing the LVQ Algorithm

  • The LVQ experiment applies the algorithm after SOM training and neuron labelling, varying the initial learning rate over 10 epochs and halving it after each epoch.The experiment uses a 10-by-10 grid.Source: §4.4.2 · pp. 23–24

Probe

Applying LVQ with an initial learning rate of 0.2 yields a net improvement in classification performance across attack types, while shifting the balance between U2R and R2L. The reported gains include a decrease for Probe attacks.

Probe

  • 4.24% net improvement in classification performance across all attack types versus no vector quantisation; U2R improves 3.45%, R2L 5.6%, DoS 0.35%, and Probe decreases 5.16%.Table 4 reports attack-classification performance for a 10-by-10 SOM after LVQ.Source: Table 4 · p. 24, Probe · p. 24
  • Changing the initial learning rate shifts the U2R–R2L trade-off; LVQ’s equal per-example updates bias weight changes toward the more frequent class, with 110 R2L versus 29 U2R training examples.A higher initial rate favours R2L, while a lower rate favours U2R.Source: Probe · p. 24
  • An initial learning rate of 0.2 gives a good compromise between detecting different attack types.The authors report that this setting improves U2R and R2L classification while Probe classification remains 94.46%.Source: Probe · p. 24

4.5 Overall Performance

The hybrid outperforms the KDD Cup winner on DoS and U2R but trails it on Probe and R2L; against the SOM hierarchy, it performs better on DoS and U2R with lower false positives.

4.5 Overall Performance

  • Direct comparison was limited to works reporting the same performance statistics, because studies grouped attack types and calculated performance differently.The compared systems were the three-layer SOM hierarchy on the same 10% dataset and the KDD Cup winning entry.Source: §4.5 · p. 25
  • Overall performance was calculated by multiplying the detection rate from Table 2 by the classification rate from Table 4.The selected settings were objective weights of 0.6 and 0.4, a 10-by-10 SOM grid, and an initial LVQ learning rate of 0.2.Source: §4.5 · p. 25
  • Compared with the three-layer SOM hierarchy, the hybrid performed better on DoS and U2R and had a lower false-positive rate, possibly because detection and classification are separated.The AIS can focus on anomaly detection, while the SOM can focus on classifying attacks.Source: §4.5 · pp. 25–26
  • Against the KDD Cup winner, hybrid detection and classification were higher for DoS (96.8% versus 83.3%) and U2R (34.6% versus 13.2%), while false-positive rates were similar.Table 5 compares the hybrid with the SOM hierarchy and the KDD Cup winner.Source: Table 5 · p. 26, §4.5 · p. 26
  • The KDD Cup winner was better on Probe (97.1% versus 64.7%) and R2L (8.4% versus 5.2%); the authors suggest more connection features may help on these attacks.The authors also describe the comparison as a trade-off: the hybrid is 2.6 times better at detecting U2R, while the winner is 1.6 times better at detecting R2L.Source: §4.5 · p. 26

5 Conclusion

The paper proposes an IDS that separates anomaly detection from attack classification, pairing detection of potentially novel attacks with higher-level attack-type information. Its KDD 1999 Cup comparisons show favorable false-positive and attack-classification results in the evaluated sample.

5 Conclusion

  • The hybrid IDS combines pure anomaly detection with higher-level information about detected anomalies, currently provided as the broad attack type.Other possible outputs include specific example attacks similar to the anomaly.Source: §5 · pp. 26–27
  • Separate detection and classification components allow attack detection without examples of specific attacks, avoiding bias toward known attack variants.The authors contrast this with signature-based misuse detection, which cannot detect attacks without a matching signature.Source: §5 · p. 27
  • On the KDD 1999 Cup dataset, comparisons with a sample of other works showed favorable false-positive and attack-classification results.The authors identify evaluating detection on novel attacks only as valuable future work.Source: §5 · p. 27
  • The system is described as the first to combine an artificial immune system with another technique at runtime as part of a hybrid IDS.Source: §5 · p. 27

A Detector Genotype for the KDD 1999 Cup Dataset

The detector genotype uses selected KDD 1999 Cup network features, with discrete and real-valued fields binned to reduce the detector search space and increase generality. Its fields encode feature values or bounds, and any field may be left unspecified.

A Detector Genotype for the KDD 1999 Cup Dataset

Loading 1208.0541v1…