An Introduction to the Use of Neural Networks for Network Intrusion Detection

Modern Society is becoming increasingly dependent upon ever-more complex systems. We are in a situation where a security breach can have an impact on individuals, institutions and critical services, such as power and communication systems. This reliance, along with the possibility of remaining both anonymous and geographically separate from an intrusion, has made cyber-crime an attractive arena for criminals. To protect their assets organisations can use a multi-layered approach to security. As well as the other areas of access control, systems which can detect if malicious or unauthorised activity is occurring are becoming more and more prevalent; intrusion detection systems are at the centre of this. Of particular benefit to intrusion detection systems are any technique with the potential to identify previously unseen patterns, such as neural networks. This chapter is concerned with the state-of-the-art of using neural networks, as part of an intrusion detection system, to identify suspicious or malicious systems traffic. We examine host based systems (where all the information is gathered from a single host) and network based systems. We examine a cross section of different types of neural networks and their application to differing types of intrusion detection.