Hybrid Hierarchical Network Intrusion Detection

A prototype of three-layer network intrusion detection system (NIDS) was designed to improve the veracity and efficiency of intrusion detection. The NIDS deals with the network layer raw data, the application layer connection session and user network behaviors. The NIDS monitors payload of packets on network layer and analyzes attacks on application layer through packets reassembly and statistical process. The system created profile using learning vector quantization (LVQ) and utilized the original LVQ algorithm to implement behavior classification. This approach exhibits the ability to detect the known and unknown network attacks. Experimental results show that the NIDS detect low-level network attacks effectively with low false positive rate and perform very well for detection of unknown attacks, especially for PROBE, DOS and U2R attacks