An Intrusion Detection Approach Based On Understandable Neural Network Trees

In this paper we presented a novel intrusion detection mode based on understandable Neural Network Tree (NNTree). NNTree is a modular neural network with the overall structure being a Decision Tree (DT), and each non-terminal node being an Expert Neural Network (ENN). One crucial advantage of using NNTrees is that they keep the non-symbolic model ENN's capability of learning in changing environments. Another potential advantage of using NNTrees is that they are actually "gray boxes" as they can be interpreted easily if the number of inputs for each ENN is limited. The experimental results are demonstrated on the KDD Cup 1999 intrusion detection dataset. The results show that the trained NNTree achieves a simple ENN at each non-terminal node as well as a satisfying recognition rate of the network packets dataset. Furthermore, the learned model contains the information about those features of critical importance for detection. One can accordingly focus his observation on those important attributes and hence decrease the complexity of the feature space. Besides, the learning results may also enlighten researchers on exploring new features for those difficult detecting attack types.