How Many Parachutists will be Needed to Find a Needle in a Pastoral?

Akira Imada

Brest State Technical University Belarus

(ICNNAI’2006 – at Brest, Belarus ) 2

Intrusion Detection by Soft-computing

CONT ENT S

• Assuming Supervised Learning

⋆ We need samples for Training & Testing · Iris-flower · KDD-cup-99

(cont’d)

CONT ENT S

• Conjecture 1

“Intrusion is like a-needle-in-a-hay-stack not like an iris family.”

• Conjecture 2

“No such algorithms to efficiently find a needle in a haystack.”

(ICNNAI’2006 – at Brest, Belarus ) 4

(cont’d)

CONT ENT S

• Warnings ⋆ Neither IRIS nor KDD-cup-99 are meaningful! ⋆ Training should be only with normal samples! ⋆ Don’t assume any expectations a priori!

• Concluding Remarks How to design an intrusion detection system

intelligently, if any?

• Two categories

⋆ Detection of known attack. ⋆ Detection of unknown no-normal.

To detect known-attacks, intelligence is not necessary but

a lookup-table is enough ⇓

Our interest is on detecting unknown no-normal.

(ICNNAI’2006 – at Brest, Belarus ) 6

General assumption:

• TCP/IP connection to a network ⇒ can be represented by an n-dimensional vector

Our Goal

To design a machine which tells the input is a normal or an attack.

Hopefully with

Detection Rate > 90% & False Alarm Rate < 10%

(ICNNAI’2006 – at Brest, Belarus ) 8

An example of NN implementation

(ICNNAI’2006 – at Brest, Belarus ) 9

A question “Is it possible or not?”

(ICNNAI’2006 – at Brest, Belarus ) 10

Training & Testing

• Frequently used two public domain datasets. ⋆ Iris-flower dataset. ⋆ KDD-cup-1999 dataset