Research of using the artificial intelligence algorithms in intrusion detection/prevention systems

Abstract

The analysis of the necessity and expediency of using artificial intelligence algorithms and technologies based on neural networks and fuzzy logic in systems for detecting and preventing network intrusions has been carried out. Modern network attacks are distinguished by the ability to change their characteristics and modes of action almost in real time. Outdated expert network protection systems based on the concept of "rule-action" can no longer cope with these types of attacks, because they need a certain time to process information about a new attack and store it into their database. The paper proposes a model of an intrusion detection/prevention system based on the use of a neural network trained on a test sample created by using fuzzy logic algorithms. The learning algorithm of the neural network is based on the method of learning with a teacher and the method of backpropagation of the error. Thus, for the complete neural network training procedure the user only needs to have a dump of the intercepted network traffic for further processing according to the test sample creation algorithm. The results of evaluation and practical testing of the proposed model show that such a network protection scheme can work quite reliably and can be used as an intrusion detection/prevention system for local and global networks.