TWO-LEVEL DETECTION OF PROBE ATTACKS BY MEANS OF NEURAL NETWORKS

Abstract

In this paper, a study of two-level detection is carried out network attacks of the Probe category by means of neural networks. The use of a multilayer perceptron is proposed configurations 31-1-124-5, where 31 is the number of input neurons; 1 – quantity hidden layers; 124 – the number of hidden neurons; 5 – quantity resulting neurons to detect the network attack category DoS, U2R, R2L and Probe (on the first level) and a self-organizing Kohonen map 10*10 to detect network attack classes according to the Probe category: Ipsweep; Nmap; Portsweep; Satan (on the second level). To detect network attacks categories Probe created using the Python language and the PyTorch «MLP1-SOM2_Probe» software model based on the implementation of proposed multilayer perceptron configurations and of the self-organizing map of Kohonen. For the organization of research, data from KDDСup99 that has been properly processed at the preparatory stage: data cleansing; selection of features; mapping of categorical features; scaling and normalization; splitting the data into appropriate samples (training, testing and validation). On the created model «MLP1-SOM2_Probe» defined optimal parameters of the corresponding neural networks: activation function, optimizer and learning speed for MLP1; the degree of influence of the neuron on nearby neurons and learning rate for SOM2. Evaluation conducted quality parameters of two-level detection of Probe attacks on the created model «MLP1-SOM2_Probe». It is determined that two-level detection of attacks on models «MLP1-SOM2_Probe» averaged about 98.8%, which allows achieve higher accuracy compared to two-level attack detection based on the use of the «MLP1-MLP2_Probe» model.