PROSPECTIVE DIRECTIONS OF TRAFFIC ANALYSIS AND INTRUSION DETECTION BASED ON NEURAL NETWORKS

A. Ilyenko, Sergii Ilyenko, I. Kravchuk, Marharyta Herasymenko
{"title":"PROSPECTIVE DIRECTIONS OF TRAFFIC ANALYSIS AND INTRUSION DETECTION BASED ON NEURAL NETWORKS","authors":"A. Ilyenko, Sergii Ilyenko, I. Kravchuk, Marharyta Herasymenko","doi":"10.28925/2663-4023.2022.17.4656","DOIUrl":null,"url":null,"abstract":"The main problems of the network security at the moment are the difficulty of combining existing systems from different vendors and ensuring their stable interaction with each other. Intrusion detection is one of the main tasks of a proper level of network security, because it is they who notify about attacks and can block them when detected. Today, monitoring and analyzing the quality of traffic in the network, detecting and preventing intrusions is helped by IDS systems and IDS systems of the new generation IPS. However, they have been found to have certain drawbacks, such as the limitations of signature-based systems, as static attack signatures limit the flexibility of systems and pose the threat of missing detection of other attacks not entered into the database. This gives rise to the creation of more and more new hybrid systems, but the challenge is to ensure their efficiency and flexibility, which is helped by the use of artificial neural networks (ANNs). This paper considers ways to improve the use of the convolutional neural network model itself by means of modified processing, data analysis, the use of Softmax and FocalLoss functions to avoid the problem of uneven distribution of sample data by the ratio of positive and negative samples, based on training using the KDD99 dataset. The article provides practical examples of possible integration of IDS and ANN systems. Combinations of backpropagation neural networks and radiant-basis neural networks, which showed some of the best results and proved that the combination of networks helps to increase the efficiency of these systems and create a flexible network adjusted to the needs and requirements of the systems. Although the use of artificial neural networks is a popular tool, it has identified a number of disadvantages: critical dependence on the quality of the dataset, which pours both the quality of networking and the amount of data (the more data, the better and more accurate the network training). But if the data is excessive, there is a chance of missing such implicit, but also dangerous attacks as R2L and U2R.","PeriodicalId":198390,"journal":{"name":"Cybersecurity: Education, Science, Technique","volume":null,"pages":null},"PeriodicalIF":0.0000,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"1","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Cybersecurity: Education, Science, Technique","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.28925/2663-4023.2022.17.4656","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 1

Abstract

The main problems of the network security at the moment are the difficulty of combining existing systems from different vendors and ensuring their stable interaction with each other. Intrusion detection is one of the main tasks of a proper level of network security, because it is they who notify about attacks and can block them when detected. Today, monitoring and analyzing the quality of traffic in the network, detecting and preventing intrusions is helped by IDS systems and IDS systems of the new generation IPS. However, they have been found to have certain drawbacks, such as the limitations of signature-based systems, as static attack signatures limit the flexibility of systems and pose the threat of missing detection of other attacks not entered into the database. This gives rise to the creation of more and more new hybrid systems, but the challenge is to ensure their efficiency and flexibility, which is helped by the use of artificial neural networks (ANNs). This paper considers ways to improve the use of the convolutional neural network model itself by means of modified processing, data analysis, the use of Softmax and FocalLoss functions to avoid the problem of uneven distribution of sample data by the ratio of positive and negative samples, based on training using the KDD99 dataset. The article provides practical examples of possible integration of IDS and ANN systems. Combinations of backpropagation neural networks and radiant-basis neural networks, which showed some of the best results and proved that the combination of networks helps to increase the efficiency of these systems and create a flexible network adjusted to the needs and requirements of the systems. Although the use of artificial neural networks is a popular tool, it has identified a number of disadvantages: critical dependence on the quality of the dataset, which pours both the quality of networking and the amount of data (the more data, the better and more accurate the network training). But if the data is excessive, there is a chance of missing such implicit, but also dangerous attacks as R2L and U2R.
基于神经网络的流量分析与入侵检测的发展方向
目前网络安全的主要问题是难以将不同厂商的现有系统组合起来,并保证它们之间的稳定交互。入侵检测是适当级别的网络安全的主要任务之一,因为是它们通知攻击并在检测到攻击时阻止攻击。如今,监控和分析网络中的流量质量,检测和防御入侵,都离不开IDS系统和新一代IPS的IDS系统。然而,人们发现它们有一定的缺点,例如基于签名的系统的局限性,因为静态攻击签名限制了系统的灵活性,并造成对未进入数据库的其他攻击的遗漏检测的威胁。这导致了越来越多的新混合系统的产生,但挑战在于确保它们的效率和灵活性,这需要使用人工神经网络(ann)。本文在使用KDD99数据集进行训练的基础上,通过改进处理、数据分析、使用Softmax和FocalLoss函数来避免样本数据正负比分布不均匀的问题,考虑如何改进卷积神经网络模型本身的使用。本文提供了IDS和ANN系统可能集成的实际示例。将反向传播神经网络与辐射基神经网络相结合,得到了一些较好的结果,并证明了网络的组合有助于提高系统的效率,并创建一个灵活的网络,以适应系统的需要和要求。尽管人工神经网络的使用是一种流行的工具,但它已经发现了许多缺点:严重依赖数据集的质量,这既影响了网络的质量,也影响了数据的数量(数据越多,网络训练越好,越准确)。但是,如果数据过多,就有可能错过R2L和U2R等隐含的、但也很危险的攻击。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 求助全文
来源期刊
自引率
0.00%
发文量
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术官方微信