High Order Layer Intrusion Detection Using Neural Networks

摘要

Methods and systems for network intrusion detection at higher order OSI layers of the network using machine learning can include the initial step of reformatting data packets that are being transmitted between two access points on the monitored network from an OSI lower level TCP/IP data packets format into an OSI Session layer or above format at a reformatting module, to yield a conversation dataset of high order conversations. The methods and systems can also include the steps of training a machine learning module using the OSI Session layer-formatted conversation dataset, and classifying the network activity as either normal or abnormal network activity using the trained machine learning module. For some embodiments and systems, the step of inspecting the TCP/IP data packet content with a rules-based module and using rules-based criteria, can be included for additional security.