paperF13_1
Artificial Neural Networks for Misuse Detection
James Cannady
School of Computer and Information Sciences
Nova Southeastern University
Fort Lauderdale, FL 33314
cannadyj@scis.nova.edu
Abstract
Misuse detection is the process of attempting to identify instances of network attacks by
comparing current activity against the expected actions of an intruder. Most current approaches
to misuse detection involve the use of rule-based expert systems to identify indications of known
attacks. However, these techniques are less successful in identifying attacks which vary from
expected patterns. Artificial neural networks provide the potential to identify and classify
network activity based on limited, incomplete, and nonlinear data sources. We present an
approach to the process of misuse detection that utilizes the analytical strengths of neural
networks, and we provide the results from our preliminary analysis of this approach.
Keywords: Intrusion detection, misuse detection, neural networks, computer security.
1. Introduction
Because of the increasing dependence which companies and government agencies have on their
computer networks the importance of protecting these systems from attack is critical. A single
intrusion of a computer network can result in the loss or unauthorized utilization or modification
of large amounts of data and cause users to question the reliability of all of the information on the
network. There are numerous methods of responding to a network intrusion, but they all require
the accurate and timely identification of the attack.
This paper presents an analysis of the applicability of neural networks in the identification of
instances of external attacks against a network. The results of tests conducted on a neural
network, which was designed as a proof-of-concept, are also presented. Finally, the areas of
future research that are being conducted in this area are discussed.