1.

INTRODUCTION

Machine learning classifiers can be used to discover the patterns hidden within large data sets, and one of the largest datasets is the information being passed through a network every day. Many information technology applications have been proposed and also used to classify network traffic [1, 2, 3, 4, 5]. Intrusion detection systems (IDS) monitor the system or network events and detect violations or threats to computer security policies, acceptable use policies, or standard security practices [6], and are one of the most significant counter measures [7, 8, 9, 10] against security threats. Intrusions can be found using signature based detection of known threats, but there are also anomaly detectors. Signature based detectors look for specific log entries or a specific payload in a data packet known to be indicative of misuse.

The IDS monitors the network traffic from a system or through a network and looks for any abnormal behavior in the network activity which indicates a possibility of unwanted and malicious network traffic and take appropriate action if such situation occurs. The IDS uses signature detection for specific known threats or anomaly detection for unknown threats to analyze the data. However, many unknown threats are merely updated versions of known threats. Since machine learning techniques can determine whether new threats are similar to known threats, there is the potential to combine anomaly detection with approximate signature detection. One of the most significant aspects of an IDS is the use of artificial intelligence [11] to train the IDS about possible threats. The Intrusion Detection can gather information about the various traffic patterns and rules can be formed based on these patterns, to distinguish between normal traffic and anomalous traffic in the network. Machine learning techniques have the ability to generalize from limited, noisy data that is not complete to broader categories on new data. This generalization capability provides the potential to recognize patterns similar to known patterns but not exactly matching. The IDS should ideally recognize not only previously observed attacks but also future attacks that have not yet been seen [12].

Some significant contributions to IDS have been made using Fuzzy Logic. Fuzzy inference combined with artificial neural networks were used for real time traffic analysis by building a signature pattern database using protocol analysis and neuro-fuzzy learning techniques [13]. Fuzzy rule-based classifiers for IDS were modeled [14]. A fuzzy intrusion recognition engine (FIRE) used Fuzzy Logic and data mining techniques to produce fuzzy sets based on the input traffic data to detect security threats [15]. Association-based classification of normal and anomalous attacks was performed on the basis of a compatibility threshold [16]. Association rules along with data mining techniques and classification was used on suspicious events in real-time [17]. Fuzzy rules gave the best detection rate when compared to linear generic programming, decision trees, and support vector machines on the DARPA 1998 dataset [18]. Fuzzy logic with an expert system performed better than 91.5% detection rate over all attack types with a reduced complexity over traditional fuzzy number ranking techniques [19]. Fuzzy adaptive resonance theory have also been used to implement network IDS [20] as well as fuzzy rules [21, 22].

A lot of work has been done on IDS using genetic algorithms. Genetic algorithms using both temporal and spatial information of the network connection during the encoding phase were used to identify anomalous network behaviors [23]. Genetic algorithms were used to find the best possible fuzzy function and select the most significant network features [24]. Genetic programming was used to derive classification rules with traffic data on the network [25]. Multiple agent technology with genetic programming was used to detect anomalies in the network [26]. A combination of information theory to filter the traffic data with genetic algorithms was used to detect anomalous behaviors in the network with reduced complexity [27].

Artificial neural networks are a popular machine learning technique, and it has been applied to IDS. A hybrid neural network was proposed using a combination of Self-Organizing Map (SOM) and Resilient Back-Propagation Neural Network (BPNN) [28]. Another hybrid system using a BPNN and a C4.5 Decision Tree was built [29] which showed that the certain network attack types could not be detected without a hybrid system. A multi-layer artificial neural network was used to classify network activity [30]. A multi-classification IDS system was built that showed a higher detection rate in each classification category than when only a single class was used to classify all non-normal data [31].

Additional approaches have included graphlets [32], decision trees [33], clustering [34], and deviation from normal traffic [35].

A system that can detect network intrusion while an attack is occurring is called a real-time detection system. There are very few real-time network IDS approaches. A real-time IDS using Self-Organizing Maps (SOM) to detect normal network activity and differentiate it from a DoS attack was proposed [37]. A Bayesian classification model for anomaly detection was also built [38]. A real-time IDS was built using two unsupervised neural network algorithms with a detection rate over 97%, separating normal traffic data from network attacks [39]. A real-time network IDS using fuzzy association rules could separate the normal network activity from network attacks [40]. A high-speed intrusion detection model using TCP/IP header information was built to detect denial of service (DoS) attacks [41].

One of the most widely used and well-known IDS is called SNORT, and it has become a standard in IDS [42]. SNORT is a commercial tool that does not use machine learning, basing its detection on regular expressions that match to known signatures of network attacks. Its attack signature rules are available only to their registered customers. The signature rules or patches have to be frequently updated and installed in order to detect current attack types or variations in known attack types.

Although some researchers are investigating real-time IDS with machine learning techniques, most of the work is based on accurate learning without good real-time performance measures and without good generalization capabilities. This paper reports its processing speed and results with SNORT as a standard.

2.

IMPLEMENTATION

Many researchers have proposed IDS classification algorithms based on machine learning techniques, but they have used older datasets from DARPA and others to evaluate their approaches. This dataset used is a network packet dataset consisting of normal network activity as well as many network attack types. The dataset is based on the DARPA98 dataset from MIT Lincoln laboratory, which provides answer class (labeled data) for evaluation of intrusion detection [36]. This dataset was created in 1998 and lacks of many current attack types. This paper uses current signatures from an IDS as an oracle for machine learning to form a new, faster IDS with the generalization capabilities of a machine learning built in. This avoids the work of manually labeling a dataset and provides more current signature information, but the quality of the initial IDS information determines the baseline for the new artificial intelligence based IDS.

Network packets are small collections of text. An N-gram can be used to break up the text into series of letters of a specified length to be used for classification [43]. This proven text processing technique is used on the network packets. However, unlike a word or a sentence, an entire network packet can be mapped into a large space of possible n-grams in series. This maps the network data packet into a very high dimensional space where machine learning can be challenging. The high dimensional space can be hashed into a lower dimensional space without losing the ability to directly match the same packet [44, 45]. However, the hash is not a unique identifier and other similar packets may have the same hash. In the high dimensional space, the network packet was unique, but that is lost when hashing down to a lower dimensional space. This approximation makes the system run faster and makes the machine learning classify better, but the approximation can result in a large number of false positives if the dimension of the hash is too small. For the networking data set that was chosen, the use of more than eight bits for the hash length was sufficient to minimize the false positives and provide nearly perfect true positives at 99.9% using a linear classifier. However, the runtime is affected by the size of the hash length, staying at nearly constant speed for hashes as long as eleven bits, but increasing exponentially after that. The runtime of the learned system was always faster and often much faster than SNORT [46].

There are multiple advantages to a machine-learning based system over a signature-based system. A signature-based system needs to store attack signatures and download new signatures when they are updated, while a machine-learning system merely updates the weights on its classifier. A signature system can be difficult to parallelize with a shared signature database, while a machine-learned system can run multiple instances due to its lightweight nature. The speed of a machine learned system was better, and that advantage only increases with the growth in the size of the signature database to search over. The machine-learned system did have slightly more false positives and did not give detailed information about the true positives, so a version of SNORT should be run on the output from the machine-learned system for labeling [46].

The primary advantage of a machine learning system over a signature system is the ability to generalize to new but similar data. This was the dream of machine learning with an IDS, that the IDS should ideally recognize not only previously observed attacks but also future attacks that have not yet been seen [12]. There are some systems that can generalize their detection well from learned attack patterns to new attack patterns [47], especially on probing attacks [48]. This system also has some ability to generalize to patterns not seen in the training data, and this was seen anecdotally in this project. Five-fold cross training was done for the linear classifier, and attacks that were only in one testing fold were still recognized. However, the detection of new attacks was not the primary goal of this project and was just the nice result of utilizing machine learning techniques. However, this project does present the path for analyzing the ability of machine learning to detect new attack types since it uses SNORT as the oracle for labeling the data. By training using an earlier version of SNORT as the oracle for training and a current version as the oracle for testing, the ability to detect new signatures can be analyzed across a large amount of time. However, a more interesting dataset may be necessary as well as improved categorization of the detections for analysis.

3.

NORMALCY CLASSIFIER AND A HYBRID INTRUSION DETECTION SYSTEM

This project aimed at prototyping a faster, less resource-intensive version of SNORT. The current network IDS setup is shown in Figure 1. The front-end with the capability to replicate the detections of a SNORT oracle are in place, with a slightly higher false positive rate. However, the labeling and analysis of detection is not implemented, so a version of SNORT should be run on the detections for labeling and analysis of the suspicious network traffic.

Figure 1.

A standard setup for a network intrusion detection system.

A hybrid system will outperform SNORT as a standalone in speed since the high percentage of network traffic will be classified as normal and not sent to the labeler, but the cost will be a marginal loss in accuracy. A hybrid system will also be more scalable, since additional normalcy classifiers can be run with significantly less overhead. The resulting system will produce the same level of labeling quality as SNORT since the abnormal traffic would be routed through SNORT. The level of false alarms would not rise since SNORT would be run on the abnormal output from the normalcy classifier. The hybrid system would run faster, scale more easily, and use far less resources than a series of SNORT instances. The cost is the slightly increased false negative rate. However, the abnormal output from the normalcy classifier may contain information about a new or unrecognized attack pattern. This output can be sent to an analyst or to an anomaly classifier.

Updates are one large advantage of a hybrid system over developing a brand-new system. Since the classifier is trained on SNORT outputs, a new signature inserted into SNORT can trigger retraining of the classifier and redistribution of the training weights. Additionally, the guarantee of no increase in false alarms as well as the consistent labeling when running the output through SNORT provide additional incentives for maintaining a hybrid system over building from scratch.

4.

CONCLUSION

We report on a machine learning classifier that can be used to discover the patterns hidden within large networking data flows. It utilizes SNORT as an oracle to learn a faster, less resource intensive normalcy classifier as a front-end to a hybrid network intrusion detection system. This system has the capability to recognize new attacks that are similar to known attack signatures. It is also more highly scalable and distributable than SNORT. The new hybrid design also allows distributed updates and retraining of the normalcy classifier to stay up-to-date with current threats.