An intrusion detection model based on Elman network is proposed to detect anomalies in network traffic. The model applies an Elman network for anomaly detection in order to provide the detector with an internal memory and therefore necessary dynamic characteristics. Unlike the existing applications of Artificial Neural Networks to detect intrusion that extract a set of attributes from only the packet headers but discard the packet payload, the present model adopts the concept of clustering the payload to alleviate information loss by retaining part of the information related to the packet payload. The model has been applied to DARPA IDS Evaluation dataset and the results demonstrate that with the two unique features, the model can identify not only intra-packet anomalies, but also inter-packet sequence anomalies.
展开▼
