Intrusion Detection using Fuzzy Clustering and Artificial Neural Network

Transcription

1 Itrusio Detectio usig Fuzzy Clusterig ad Artificial Neural Network Shraddha Suraa Research Scholar, Departmet of Computer Egieerig, Vishwakarma Istitute of Techology, Pue Idia Abstract This paper presets the outlie of a hybrid Artificial Neural Network (ANN) based o fuzzy clusterig ad eural etworks for a Itrusio Detectio System (IDS). While eural etworks are effective i capturig the o-liearity i data provided, it also has certai limitatios icludig the requiremet of high computatioal resources. By clusterig the data, each ANN is traied o a particular subset of data, reducig time required ad achievig a higher detectio rate. The outlie of the implemeted algorithm is as follows: first the data is divided ito smaller homogeeous groups/ subsets usig a fuzzy clusterig techique. Subsequetly, a separate ANN is traied o each subset. Fially, Results of each ANN from step 2 is aggregated to form the fial output which will decide the classificatio of the data poit. Keywords: Artificial Neural Network, Itrusio Detectio System, Fuzzy clusterig Itroductio Itrusio detectio is a importat aspect i today s world where security is of utmost importace. A sigle itrusio i a etwork ca cause iformatio leaks or data modificatio which ca prove to be hazardous to ay compay or orgaizatio. A itrusio detectio system attempts to detect misuse or uauthorised access of a system or a etwork. A IDS does ot usually perform ay actio to prevet itrusios; its mai fuctio is to alert the system admiistrators that there is a possible security violatio; as such it is a proactive tool rather tha a reactive tool []. Itrusio detectio systems (IDS) ca be classified as: () Host based or Network based (2) Olie or Offlie (3) Misuse based or Aomaly based. A host based IDS makes use of log files from idividual computers, whereas a etwork based IDS captures packets from the etwork ad aalyses its cotets. A olie IDS is able to flag a itrusio while it s happeig whereas a offlie IDS aalyses records after the evet has occurred ad raises a flag idicatig that a security breach had occurred sice the last itrusio detectio check was performed. A Aomaly based IDS detects deviatio from ormal behaviour while misuse based IDS compare activities o the system with kow behaviours of attackers. This paper outlies a hybrid approach usig Artificial Neural Networks ad Fuzzy clusterig to detect itrusios i a etwork. The method outlied is etwork based which extracts features from packets i the etwork. The algorithm classifies the packet as ormal or the type of attack depedig upo the cotets of the packet. Attacks fall ito four mai categories: Deial of Service (DoS); User to Root (U2R); Remote to Local (R2L) ad Probe. The KDD repository was used to trai the algorithm. Neural etworks which are a class of machie learig algorithms used to classify data ca be used where the problem is too complex to be programmed by had. Istead, the eural etwork is traied to give more importace to the features that are the mai characteristics of a particular class i order to help the etwork classify the icomig data. Neural etworks have bee successfully implemeted [2] [3] [4] to detect itrusios. Neural etworks, however, require substatial amout of data to trai o, before they ca successfully classify icomig data. Due to this limitatio, the eural etwork is ot able to trai well o low frequecy attacks such as R2L ad U2R resultig i their lower detectio accuracy ISBN:

2 [5]. Differet hybrid approaches have bee explored i the past to overcome the drawbacks of ay oe idividual method [6] [7] [8]. The two approaches used i this paper viz. ANN ad Fuzzy clusterig are used so that they complemet each other. Neural Networks are good at beig able to classify usee data poits whereas fuzzy clusterig eables the algorithm to geeralize well. 2 Research Backgroud Various approaches usig ANN have bee used for IDS. The Neural Network Itrusio Detector (NNID) system proposed by Rya et al. [9] took ito accout the behaviour of idividual users ad created profiles for each user. The iput patter was the matched to the user profiles to idetify the user (A ode correspodig to a user with value >.5 is attributed to that user). A flag was raised if o match was foud ad the iput was cosidered as a aomaly. However, this required large amout of data to trai the etwork for each user. Isufficiet data for a user might lead to false positives for that user s behaviour o the etwork [9]. The NNID system had a aomaly detectio rate of 96% ad a false alarm rate of 7%. The Multi-layered Perceptro (MLP) by Caady [] usig backpropagatio algorithm modelled geeral use rather tha creatig user specific profiles. Traiig of the eural etwork required 26.3 hours to complete with approximately 98% match i the traiig dataset ad 97.5% match i the test dataset. I cotrast to the above two approaches that used backpropagatio algorithm, Silva, et al. [] used a Hammig Net to classify etwork evet i real time. The Hammig Net is a fast patter matcher that fids the most similar class, accordig to a pre-defied similarity threshold, providig great flexibility ad fault tolerace by fidig small attack variatios. O a average 7% of wellkow malicious iput data withi the payload file ecoutered its commo pair i the exemplar file ad is classified as suspicious iformatio. Lei ad Ghorbai [2] compared the performace of Self-Orgaizig Map (SOM) ad Improved Competitive Learig Networks (ICLN). While the accuracy obtaied for both SOM ad ICLN were similar, the computatio time for SOM was geerally higher tha that of ICLN (specifically, ICLN requires oe fourth the computatioal time of the SOM). The clusterig result is also idepedet of the umber of iitial euros which is ot the case i SOM. The results of the simulated aealig approach i Gao ad Tia s [3] paper show that the mea squared errors of traiig samples of improved simulated aealig eural etwork is smaller tha that of a backpropagatio etwork. Moreover the mea squared errors of testig samples of improved simulated aealig eural etwork is also smaller tha that of a backpropagatio etwork. Whe the umber of the traiig samples chage, we ca get the same result. It shows that the etwork itrusio detectio method based o improved simulated aealig eural etwork has higher stability, ad ca obtai higher detectio ad recogitio accuracy. The Probabilistic Neural Network (PNN) implemeted by Devaraju ad Ramakrisha [4] performs better tha Feed Forward Neural Network (FFNN) ad Radial Basis Neural Network (RBNN). However, PNN (accuracy = 8.38%) performs oly.2% better tha FFNN (accuracy = 8.4%) which is ot a sigificat differece. The accuracy of RBNN is 75.4%. These results are comparatively lower as compared to other algorithms implemeted i the other papers discussed above. The hybrid approach preseted i Wag et al. [5] usig fuzzy logic ad artificiaann eural etwork have obtaied a average accuracy of 96.7% which ca be cosidered as very successful. The fuzzy logic provides some flexibility to the ucertai ature of detectig itrusios [6]. The hybrid approach i this paper implemets fuzzy clusterig ad ANN. Fuzzy clusterig - a form of usupervised techique is used to divide the traiig data ito smaller groups/ subsets. ANNs are traied usig these subsets. Sice the size of data is reduced, the traiig time required to trai each ANN is also reduced. Aggregatig the results of these idividual ANNs by a fial aggregatig ANN helps icrease its detectio rate as ay misclassificatios made by idividual ANNs will be corrected by the fial aggregatig ANN. Thus the objective is to lower the traiig time required while icreasig the detectio rate of idetifyig attacks. 3 Problem Solutio Figure shows the geeral outlie of the method usig Fuzzy Clusterig ad Artificial Neural Network (FCANN). The dataset used for the experimets is the 999 KDD Cup dataset. This dataset cotais about five millio coectio records as traiig data ad about two millio ISBN:

3 coectio records as test data. It icludes a set of 4 features derived from each coectio ad a label which specifies the status of coectio records as either ormal or the specific type of attack. Radom records are take from the traiig set ad give to the fuzzy clusterig module (the first module). This module divides the traiig sets ito smaller clusters. Each cluster forms a subset to be give to every ANN i the ANN module (secod module). Each ANN trais o this subset to classify a record as oe of the five groups ormal, DoS, U2R, R2L ad Probe. This output is the give to the third module the fial aggregatig module. The aggregator ANN takes the outputs of the idividual ANN ad trais o them to reduce ay misclassificatios. This module gives the fial classificatio of the record. Module : Fuzzy Clusterig The traiig data is divided ito x umber of clusters such that there is homogeeity withi the clusters ad heterogeeity betwee clusters. Each data poit belogs to a particular cluster with the degree specified by its membership grade. The traiig set is thus divided ito several subsets decreasig the size ad complexity of each subset. The Fuzzy c-meas (FCM) clusterig algorithm origially itroduced by Bezdek [7] is used to divide the data ito several clusters. The FCM algorithm is based o the miimizatio of the followig objective fuctio [8] [9]: k J m = u ij m x i c j 2, j= i= < m < where, u deotes the degree of membership of data poit x fallig ito cluster ceter c ad m is the weightig expoet greater tha. The fuzzy clusterig module is composed of the followig steps:. Fix c ad m ad radomly iitialize x umber of cluster ceters. Iitialize membership matrix U to U() ad step k=. 2. At each step k, calculate the cluster ceters with the membership matrix U(k) c j = i= u ijx i i= u ij 3. Compute a updated membership matrix U(k+) u ij = k ( x i c j p= x i c p ) 2 m Fig Block diagram of fuzzy clusterig ad ANN for IDS 3. Traiig The FCANN algorithm ca be divided ito three submodules viz. fuzzy clusterig; ANN; ad fuzzy aggregatio. The followig sectios describe these three submodules i detail. 4. Compare U(k+) ad U(k). If U (q + ) U (q) < ε the stop. Otherwise set U(k) = U(k + ) ad retur to step 2. Oce the termiatio criteria is reached, the whole traiig set is divided ito x umber of subsets, each of which is give to a differet ANN for learig features specific to that subset. ISBN:

4 Module 2: Artificial Neural Network The ANN module cosists of a separate ANN for each cluster formed ad aims to lear the patters preset i every subset. A simple feed-forward etwork is used for each ANN which cosists of simple processig uits called odes ad weighted coectios betwee odes i adjacet layers. The ANN employed i our experimets uses three layers - iput, hidde ad output layer. Data is give at the iput layer ad is traversed through the eural etwork ad is classified ito oe of the five classes at the output layer. The five classes are: Normal, DoS, U2R, R2L ad Probe. To lear the weights of this multi-layered eural etwork we use the backpropagatio algorithm with the gradiet descet weight update rule. The gradiet descet aims to miimize the squared error betwee the ANN predicted output ad the actual target values. The error fuctio used is: E m = 2 (T k Y k ) 2 k The back propagatio algorithm used to trai the ANN is outlied as follows [2]:. Create a ANN with umber of iput odes correspodig to the umber of features i the dataset; the umber of output odes correspodig to the umber of output classes ad a appropriate umber of hidde layer odes. 2. Iitialize the weights to small radom umbers. 3. For every traiig example, forward propagate the iput through the etwork: a. Each hidde ode receives the weighted summatio of the iputs ad bias hid(j) = b j + x i w ij i= where j is the j th hidde uit ad i deoted the i th example b. This is the passed through a oliear activatio fuctio. A uipolar sigmoid activatio fuctio is used: f(x) = ( + exp( x)) c. Output of the hidde layers is the give to the output layer i a similar maer: y(k) = b k + x i w ik i= ad is passed through the activatio fuctio d. The output computed through the ANN is the compared to the target value ad the error is calculated usig the error fuctio 4. This error is the backpropagated through the ANN ad the weights updated accordig to the expressio: w(t + ) = w(t) η E(t)/ w(t) where t is the umber of epochs ad η is the learig rate. 5. The mometum parameter α (< α <) is used to accelerate the learig process w(t + ) = w(t) η E(t) w(t) + α w(t) 6. If the error E m < threshold defied the stop traiig. Else retur to step 3. Thus i the ANN module every idividual ANN is traied o its ow subset ad the resultig output is the give to the fial aggregatig ANN. Module 3: Fuzzy Aggregatio Oce the idividual ANNs have bee traied o their subsets, their results must be aggregated to reduce ay errors itroduced by idividual ANNs i the ANN module. To achieve this, aother ANN is used to lear ad remove errors made by the sub ANNs. The followig steps are used to accomplish this task [5]:. Forward propagate the whole traiig set through every sub ANN i module two. Each sub ANN will output its opiio as to which class the particular record must fall ito. 2. This output of ANN x (oe sub ANN i module two) is multiplied by its membership grade belogig to the cluster the sub ANN was traied o. ISBN:

5 3. The iput to the fial aggregatig ANN is 3.2 Testig Y iput = [y. U ; y 2. U 2 ; ; y. U ] The output is compared with the target output. The aggregatig ANN uses the same backpropagatio algorithm used for the idividual sub ANNs i the ANN module. Durig the stage of testig, the workig methodology of ANN module ad fuzzy aggregatio module is similar as described above. First, the membership grade is calculated based o the cluster cetres C. For a ew iput x i, the membership U is calculated based o C by: u ij = k ( x i c j p= x i c p ) 2 m Oce the membership of the iput data is determied, the data poit is give to the ext ANN module. The outputs of all the ANNs i module 2 are the aggregated usig the fial ANN to determie which class the iput should be classified as. The test data used has cases ot see by the etwork durig the traiig phase. Thus, the testig will ot oly test the system o previously see data but also o usee data. This makes the itrusio detectio task more realistic. The time take for traiig is to be oted dow for various combiatios of parameters (learig rate ad mometum). The test set will be preseted to the system with those parameters ad the detectio rate oted. The ideal combiatio is to have miimum traiig time ad maximum detectio rate for the test set. 4 Experimets ad Results 4. Experimet The software used to implemet the FCANN algorithm was MATLAB R28a o a Widows7 PC with i5 core 2.3 GHz CPU ad 4GB RAM. I the experimets, KDD CUP 999 [2] dataset is used which is a versio of the origial 998 DARPA itrusio detectio evaluatio program dataset. Radom selectio was used to reduce the size of the dataset. Table shows detailed iformatio of the umber of records used to trai the etwork. The kddcup data percet dataset was used for traiig. All the records belogig to U2R, R2L ad Probe attacks were selected due to their low frequecy i the dataset. 3, Normal records ad, DoS records were radomly selected [5]. Table Number ad distributio of traiig ad test dataset Coectio type Traiig dataset Number % of of records records Testig dataset Number % of of records records Normal , DoS, , U2R R2L , Probe The KDD dataset cotais 4 features ad the class of attack (or ormal). Symbolic value features such as protocol_type are coverted to umeric values to be give to the ANNs. The dataset is ormalized before beig used so that all feature values are i cosistet rages. The traiig data was divided ito 6 clusters i the fuzzy clusterig module [5]. Each subset was the give to its idividual ANN i the ANN module (2 d module). This ANN has 4 iput odes correspodig to the 4 features i the dataset; 5 output odes correspodig to the five classes viz. Normal; DoS; R2L; U2R ad Probe. The umber of hidde odes was determied usig the empirical formula I + O + α where I is the umber of iput odes, O is the umber of output odes ad α is take as due to the complexity of itrusio detectio [5]. Thus, the secod module ANN architecture is The output of the secod module is give to the fial aggregatig module. Thus the iput features to the fial aggregatig ANN is 5. The umber of output odes too will be 5 correspodig to the 5 output classes ad the umber of hidde layer odes are 3 calculated usig the formula stated above. The fial ANN architecture is ISBN:

6 Table 2 Traiig time take for various values of mometum ad learig rate Traiig time Learig Rate take (CPU secods) Mometum Test set detectio rate(%) Mometum Table 3 Test set detectio rate for various mometum ad learig rate values Learig Rate Results Table 2 shows the traiig time take i CPU secods for various values of mometum ad learig rate ad Table 3 shows the detectio rate over the test set o the traied eural etwork. The same radom dataset geerated was used for all the experimets. Figure 3 shows the test set detectio rate for error threshold of.. It ca be see from the figure that higher detectio rate is obtaied for higher learig rate ad lower mometum values. The geeral tred see i the traiig time take from Figure 2 is that as learig rate icreases (from. to ) the traiig time decreases. A higher learig rate leads to faster covergece to the global miima. Higher mometum also leads to lower traiig times as the covergece takes place i the right directio. ISBN:

7 Traiig Time 3 Test Accuracy 9 Traiig Time take (sec) Learig rate Mometum Accurcy (%) Learig rate Mometum Fig 2 3D plot for Traiig time take with error threshold of. Fig 3 3D plot for Test set detectio rate with error threshold of. To uderstad how the clusters are formed ad how they affect the performace of the ANN, the records belogig to each class i each cluster were idetified. The distributio of records i the 6 clusters formed is as show i Table 4. The detectio rate of the traiig ad test set, the cluster it belogs to ad the classes idetified by each ANN are show i Table 5. Table 4 Distributio of records i each cluster produced by the FCM algorithm Class Cluster Number Total Normal ,82 3, DoS 2,73 7, , U2R 5 52 R2L ,26 Probe, , ,7 ANN Table 5 Aalysis of ANN output i module 2 ad module 3 Traiig detectio rate (%) Cluster Test set detectio rate (%) Classes idetified DoS; Probe Normal; DoS; R2L; Probe Probe Normal; DoS; U2R; R2L; Probe DoS Normal; DoS; R2L; Probe Fial aggregatig ANN Normal; DoS; U2R; R2L; Probe ISBN:

8 The FCM algorithm clusters data such that the records withi each cluster are similar as ca be verified from Table 4. Cluster cotais oly Probe records ad cluster 3 cotais maily DoS records. Cluster 6 is the oly cluster that has sigificat amout of records from all classes. The values i Table 5 were take for learig rate =.8, mometum =.6 ad error threshold=.. These values were chose as they gave a good combiatio of low traiig time ad high detectio rate (refer Table 2 ad Table 3). Cluster which had all Probe records, gave a % traiig detectio rate but oly.34% i the test set. This is because the ANN traied o cluster received all Probe records ad hece it classified all records as Probe achievig % i traiig set. For the test set too, it classified all records as Probe givig it a very low detectio rate of.34% (the percetage of Probe records i test set). Exactly similar is the case for cluster 3 where the ANN classifies all icomig records as DoS. Sice 73.89% of the test set is made of DoS records, its test set detectio rate too is 73.9%. Though the detectio rate is high, it is merely due to the large umber of DoS records preset i the test set ad ot because the ANN has leart to classify correctly. This basically reders ANN 3 ad ANN 5 (belogig to cluster ad 3 respectively) redudat as it classifies all records as Probe ad DoS respectively. If the data withi each cluster is too homogeeous (belogig to the same class), the ANN will just flag ay data as belogig to that particular class. Due to this, the membership grades play a importat role as it effectively decides the iput values to the 5 odes of the fial aggregatig ANN. For this, the membership grade of the records belogig to the differet clusters must have sigificat differece to overcome the default output of each ANN. However, upo ispectio it was foud that the membership grades of the records do ot differ sigificatly from each other. This makes gettig the records classified correctly at the module 2 level more importat. Due to this, majority of the load i classifyig the record correctly falls o the fial aggregatig ANN. 5 Coclusio ad Future work I this paper, the FCANN algorithm was implemeted to detect etwork itrusios. The algorithm was implemeted with several combiatios of learig rate ad mometum to fid the best learig rate ad mometum combiatio which gives a lower traiig time ad higher detectio rate. The results of each module of the algorithm are aalysed to uderstad its workig. Results have show that homogeeity withi each cluster is ot preferable ad is ot a ideal way to divide the traiig data. Each ANN must receive records belogig to differet classes to get a better traiig at classifyig records. A ideal way to divide the data to achieve good results (low traiig ad high detectio rate) remais a ope problem for future research. Refereces [] W. W. Fu ad L. Cai, A Neural Network based Itrusio Detectio Data Fusio Model, i Third Iteratioal Joit Coferece o Computatioal Sciece ad Optimizatio, 2. [2] C. Zhag, J. Jiag ad M. Kamel, Itrusio Detectio usig hierarchical eural etworks, Patter Recogitio Letters, pp , 25. [3] X. Tog, Z. Wag ad H. Yu, A research usig hybrid RBF/ Elma eural etworks for itrusio detectio system secure model, Computer Physics Commuicatio, pp , 29. [4] S.-C. O. K. Y. Woil Kim, Itrusio Detectio Based o Feature Trasform Usig Neural Network, i Computatioal Sciece - ICCS 24, vol. 337, Spriger Berli Heidelberg, 24, pp [5] R. Beghdad, Critical study of eural etworks i detectig itrusios, Computers & Security, pp , 28. [6] G. Liu, Z. Yi ad S. Yag, A hierarchical itrusio detectio model based o the PCA eural etworks, Neurocomputig, pp , 27. [7] L. Re, Research of Web Data Miig based o Fuzzy Logic ad Neural Networks, i Sixth Iteratioal Coferece o Fuzzy Systems ad Kowledge Discovery, 26. [8] F. M.-P. F. J. M.-G. R. L.-F. J. A. G.-M.-A. D. M.-J. Ire Lorezo-Foseca, Itrusio detectio method usig Neural Networks based o the reductio of characteristics, i Bio-Ispired Systems: Computatioal ad Ambiet Itelligece, vol. 557, Spriger Berli Heidelberg, 29, pp [9] J. Rya, M.-J. Li ad R. Miikkulaie., Itrusio Detectio with Neural Networks., ISBN:

9 i AAAI Techical Report WS-97-7., 997. [] J. Caady, Artificial Neural Networks for Misuse Detectio, i Natioal Iformatio Systems Security Coferece (NISSC 98), Arligto, VA., 998. [] L. d. S. Silva, A. C. F. d. Satos, J. D. S. d. Silva ad A. Motes, A Neural Network Applicatio for Attack Detectio i Computer Networks., i ISBN , 24. [2] J. Zhog Lei ad A. Ghorbai, Network Itrusio Detectio usig a Improved Competitive Learig Neural Network, i Proceedigs of the secod aual coferece o commuicatio etworks ad services research (CNSR 4) ,, 24. [3] M. Gao ad J. Tia, Network Itrusio Detectio Method Based o Improved Simulated Aealig Neural Network, i Iteratioal Coferece o Measurig Techology ad Mechatroics Automatio, 29. [4] S. Devaraju ad D. S. Ramakrisha, Performace aalysis of itrusio detectio system usig various eural etwork classifiers, i IEEE-Iteratioal Coferece o Recet Treds i Iformatio Techology, ICRTIT, MIT, Aa Uiversity, Cheai, 2. [5] G. Wag, J. Hao, L. Huag ad J. Ma, A ew approach to itrusio detectio usig Artificial Neural Networks ad Fuzzy clusterig, Expert systems with applicatio, vol. 37, pp , 2. [6] N. B. Idris ad B. Shamugam, Artificial Itelligece techiques applied to Itrusio Detectio, i IEEE Idico 25 Coferece, Cheai, Idia, 25. [7] J. C. Bezdek, Patter Recogitio with Fuzzy Objective Fuctio Algorithms, 98. [8] J. C. Bezdek, R. Ehrlich ad W. Full, FCM: The Fuzzy c-meas clusterig algorithm, Computers & Geoscieces, vol., o. 2-3, pp. 9-23, 984. [9] C. L. Stephe, Fuzzy model idetificatio based o Cluster Estimatio, Joural of Itelliget ad Fuzzy systems, vol. 2, pp , 994. [2] T. M. Mitchell, Machie Learig, McGraw- Hill, 997. [2] KDD Cup 999, [Olie]. Available: dcup99.html. [Accessed August 22]. ISBN: