Detecting Abnormal Network Traffic in the Secure Event Management Systems

Abstract

State-of-the-art intrusion detection and monitoring systems produce hundreds or even thousands of events every day. Unfortunately, most of these events are false positives, or irrelevant and can be considered as background noise, which makes their correlation, analysis and investigation very complicated and resource consuming. This paper attempts to simulate the modeling of background noise using the non-stationary time series analysis with lag smoothing Kalman filter. Then introduce and compare a second technique applying a multilayered perceptron neural network with back propagation network; an approach that is used for the first time in modeling and correlating the background noise. DARPA Dataset is used to analyze and compare both techniques and finally a verification experiment is conducted using a gathered dataset from real network environment.

Ensemble Classifiers for Network Intrusion Detection Using a Novel Network Attack Dataset

“…In the world of network attacks, since the signatures of different attacks are quite distinct from one another, it is normal to have different sets of features as well as different ML algorithms to detect different types of attacks. It is thus obvious that a single IDS cannot cover all types of input data or identify different types of attacks [20,21]. Many researchers have shown that classification problems can be solved with high accuracy when using ensemble models instead of single classifiers [22].…”