一种基于反馈神经网络的异常检测方法

目前的入侵检测系统缺乏从先前所观察到的进攻进行概括并检测已知攻击的细微变化 的能力。描述了一种基于最小二乘估计(LS)模型的入侵检测算法,该算法利用神经网络的特点,具 有从先前观测到的行为进行概括进而判断将来可能发生的行为的能力。提出了一种在异常检测中用 反馈神经网络构建程序行为的特征轮廓的思想,给出了神经网络算法的选择和应用神经网络的设计 方案。实验表明在异常检测中利用反馈神经网络构建程序行为的特征轮廓,能够提高检测系统对偶 然事件和入侵变异的自适应性和异常检测的速度。

Method of anomaly detection based on feedback neural network

Current intrusion detection systems lack the ability to generalize from previously observed attacks and to detect even slight variations of known attacks. An approach employing LS and neural networks was described to provide the ability to generalize from previously observed behavior and to recognize future unseen behavior. The method was represented to use feedback neural networks in anomaly detection to structure the characteristic pattern of the short sequences of system calls. Meanwhile, the algorithm and design of the neural network were given. Experiment shows that the neural network is especially better to deal with events and variance of intrusions and improves the detection rate without increasing the false positives.