METHOD FOR TRAINING A HIERARCHICAL NEURAL-NETWORK INTRUSION DETECTOR

摘要

An intrusion detection system comprising a hierarchy of neural networks that functions as a true anomaly detector is disclosed. Detection of an anomaly is achieved by monitoring selected areas of network behavior, such as protocols, that are predictable in advance. The neural networks are trained using data that spans the space of network or system inputs. The desired neural network output used during training is determined using the known properties of the network behavior. The trained detector recognizes attacks that were not specifically presented during training. In fact, using small detectors in a hierarchy structure provides gives a better result than a single large detector.