Abstract

Intrusion detection and prevention is a set of techniques that try to detect attacks as they occur or after the attacks took place. There are two recent and useful approaches to detect intrusions: misuse and anomaly. They collect network traffic activities from some points on the network or computer system and then use them to secure the network using one or both of the available detection methods. The IDPS suffer major vulnerabilities with large generation of false positives and negatives. The anomaly detection aims to specify behavior detection problems that require modeling of profile preliminary. This paper describes a new approach of intrusion detection based on specified profile built from training basis using a database that contains normal activities collected within monitored network. The modeling of profile represents a real challenge for network administrators and computer security researchers. Our main goal is in the first hand, to present an application of multilayer perceptron to make a monitored system, in the second hand, to build a classifier for traffic events. A supervised algorithm is suggested and used in training. The recognition phase aims to validate the new classifier. Our classifier is able to distinct between normal activity and intrusion. We describe in details our novel detection approach and we validate the proposed solutions. We demonstrated that this novel approach is robust, flexible and gives useful performances using multilayer perceptron.