Intrusion detection system modeling based on neural networks and fuzzy logic

Modern computer network IDS (Intrusion Detection Systems) and IPS (Intrusion Prevention Systems) increasingly use SOM (Self-Organizing Map) in classification of network traffic process. In this research, training data preparation is implemented as a preprocessing block composed of SOMs. Several networks with different characteristics are linked cascade and parallel for the purpose of creating SOM block. This block is used for reduction of training data through process of clustering data in smaller subsets. Training data are divided in clusters and used for training of ANFIS (Adaptive Network Based Inference System) components of the system. IDS hybrid structure consists of SOM block cascade linked with fuzzy system. The proposed hybrid structure is trained, tested and validated using KDD CUP 99 data set. This paper presents advantages and disadvantages of hybrid approach based on neural networks and fuzzy logic comparing it to similar solutions that can be found in the literature. New refined training data set is prepared with proposed solution. Overall classification using this solution, gives better results for one class compared to best results of KDD CUP 99 competition and other recently developed solutions.