An Efficient Network Intrusion Detection System Using Clustering and Fuzzy Logic"

Abstract

Computer networks are one of those unique gifts of modern science which enriched human life with the blessing of global connectivity. But as the networks advanced the problem of intrusions and misuse of the computer systems followed with an increasing rate. Intrusion detection systems were developed in order to defend computer networks against continuous evolution of various types of attacks. They play an important role in network security asthey are considered to be the last line of defense in any network. Therefore, they are the subject of ongoing research for many years and have received a lot of attention in various research areas such as, machine learning and data mining. In dynamic network environment, where the traffic patterns are always changing and huge amount of data are coming every second, it is a real difficult job to process the huge amount of data to detect intrusions and at the same time adapting to the change in the traffic pattern to detect novel attacks and also preventing normal traffic from being misclassified as attack. The proposed approach uses unsupervised learning with the help of Self-Organizing Map neural network to be able to isolate unseen patterns and predict its suspicious nature from neighboring map units. To have a finer classification of the group of data corresponding to a map unit, a small fuzzy rule-base has been built for every map unit. The small fuzzy rule-base corresponding to the selected map unit will be updated if a new attack occurs, rather than the entire model, thus we can avoid the processing overhead to a great extent. This technique gives flexibility to the security administrator to decide the degree of security an administrator wants in the system with the use of fuzzy logic. It is also adaptable in dynamic network environment. This dissertation work has been implemented in Matlab R2006a running in Windows Vista. All the experiments were performed and results compared on Intel Core 2 Duo 1.8 GHZ processor with a 2 GB RAM.