An enhanced Hopfield neural network model for misuse intrusion detection system

Other Title(s)

نموذج محسن لشبكة هوبفيلد العصبية لكشف التطفل في نظام المعلومات

Dissertant

al-Nuaymat, Ziyad Jamil

Thesis advisor

Naum, Riyad Shakir

Comitee Members

Abbadi, Muhammad Ali
al-Shammari, Husayn Hadi Uwayyid

University

Middle East University

Faculty

Faculty of Information Technology

Department

Computer Science Department

University Country

Jordan

Degree

Master

Degree Date

2013

English Abstract

According to the rapid expansion of networks over the past century, system protection has become one of the most important issues in Computer Systems due to the existence of gaps in most of the components of protection systems such as FIREWALL systems.

In the last past years, several research were proposed, developed and designed to set ideas based on several techniques to design systems intrusion detection to protect the system, analyze and expect the behaviors of users.

Misuse intrusion detection is the process that searches attack patterns in the source of data to identify instances of network attacks by comparing current activity against the estimated actions of an intruder.

Thus intrusion detection systems (IDS) are used as secondary computer systems protector to identify and avoid illegal activities or gaps.

The intrusion detection problem is considered as apattern recognition, and the artificial neural network must be trained to distinguish between normal and unusual patterns (DoS, Prob., R2L, U2R).

In this thesis, two hybrid neural models were developed; Enhanced Hopfield neural network with K-means clustering algorithms(HNKMIDS) and Enhanced Hopfield neural network with K-Nearest clustering algorithms (HNKNNIDS).

The two models consist of three phases: Phase one: - In this phase, K-means clustering algorithms or K-nearest neighbor are used (clustering phase).

Phase two: - Enhanced Hopfield artificial neural network is used in this phase (Training Phase).

Phase three: Multi-class support vector machine is used in this phase (Testing Phase).

Our results have shown that the two models, HNKMIDS and HNKNNIDS, were able to classify normal class and intrusion classes with good detection rate during less time.

In the two models, for evaluation, the KDD Cup’99 network used in misuse intrusion detection data set.

The result, from using the two models, demonstrates that the two proposed model have detection rate as follows - The first model HNKMIDS, has a Classification rate of about 99.38% with Accuracy rate 99.39%.

- The second model HNKNNIDS, has a Classification rate of about 81.08% with Accuracy rate 94.69%.

Thus, the two proposed models produce substantial improvements (FPR, FNR and Accuracy Rate) over other algorithms.

Main Subjects

Information Technology and Computer Science

No. of Pages

89

Table of Contents

• APA
• MLA
• AMA

Language

English

Data Type

Arab Theses

Record ID

BIM-694065