The neural network models for IDS based on the asymmetric costs of false negative errors and false positive errors

Abstract

This paper investigates the asymmetric costs of false positive and negative errors to enhance the IDS performance. The proposed method utilizes the neural network model to consider the cost ratio of false negative errors to false positive errors. Compared with false positive errors, false negative errors incur a greater loss to organizations which are connected to the systems by networks. This method is designed to accomplish both security and system performance objectives. The results of our empirical experiment show that the neural network model provides high accuracy in intrusion detection. In addition, the simulation results show that the effectiveness of intrusion detection can be enhanced by considering the asymmetric costs of false negative and false positive errors.

Introduction

The rapid growth of networks in information systems has resulted in the increasing attention to Intrusion Detection Systems (IDS), which many companies have adopted to protect their information assets (Verwoerd and Hunt, 2002). IDS are the software with the functions of detecting, identifying and responding to unauthorized or abnormal activities on a target system (Denning, 1987, Richards, 1999). Intrusion Detection is an area with increasing concerns in the Internet community. In response to this concern, many automated IDS have been developed (Biermann et al., 2001). In recent years, data mining techniques such as statistical methods and artificial approaches have been successfully applied in the context of network intrusion detection (Heatley and Otto, 1998). Data mining is a process of sifting through large volumes of data to discover trends and patterns. Most of the IDS designed so far, however, have difficulty in accurately classifying intrusive attempts. IDS inevitably make errors even though many techniques are employed for detecting fatal attacks on a server.

The purpose of IDS is to distinguish between intruders and normal users. It is difficult to remove all possible errors due to the enormous variety and complexity of today's networks. Although data mining has become a very useful technique by reducing the information overload and improving the performance of IDS, two types of errors result in evoking inevitable IDS costs. These errors consist of false positive errors and false negative errors in IDS. The false positive errors occur because the IDS sensor misinterprets normal packets or activities as an attack. These errors can degrade the productivity of the systems by invoking unnecessary countermeasures. On the other hand, false negative errors occur because an attacker is misclassified as a normal user. A fatal problem may arise from a false negative error as unauthorized or abnormal activities generate unexpected or undesirable operations of the systems. False negative errors cause great losses for organizations which are connected to the systems by networks. The risk of false negative errors is higher than the risk for false positive errors. However, most studies of IDS that employ the data mining techniques have focused on improving the prediction ability for unauthorized or abnormal users (Heatley and Otto, 1998).

In most cases of the operation of IDS in organizations, IDS operators rely on their experience to identify and resolve unexpected false negative error issues (White et al., 1996). This study proposes a method to analyze and reduce the total costs based on the asymmetric costs of errors in the IDS. This study adopts the neural network model, which has shown successful results for detecting and identifying unauthorized or abnormal activities from the networks (Lee et al., 1999). The objective of the proposed method is to minimize the loss for an organization under an open network environment. This study employs the neural network model for intrusion detection. Furthermore, the study analyzes the cost-effectiveness of the false error levels and presents experimental results for the validation of our intrusion detection model.

The remainder of this paper consists of four sections. The next section presents the introduction of IDS and the studies of data mining approaches for IDS. The research model of this study is addressed in detail in Section 3. In Section 4, the asymmetric costs of false negative errors and false positive errors are validated by experimental results. Finally, this paper is concluded with the summary, contributions and limitations.