SE MS Thesis Presentation of Daniel Rossell

TITLE: Network Anomaly Detection Using Adaptive Resonance Theory ABSTRACT: This thesis focuses on the problem of anomaly detection in computer networks. Anomalies are often malicious intrusion attempts that represent a serious threat to network security. Adaptive Resonance Theory (ART) is used as a classification scheme for identifying malicious network traffic. ART was originally developed in the field of biology as a way to explain how the human eye categorizes visual patterns. For network intrusion detection, the core ART algorithm is implemented as a clustering algorithm that groups network traffic into clusters. A machine learning process allows the number of clusters to change over time to best conform to the data. Network traffic is characterized by network flows, which represent a packet, or series of packets, between two distinct nodes on a network. These flows can contain a number of attributes, including IP addresses, ports, size, and duration. These attributes form a multi-dimensional vector that is used in the clustering process. Once data is clustered along the defined dimensions, anomalies are identified as a data points that do not match known good or nominal traffic. The ART clustering algorithm is tested on a realistic network simulation that was generated using the network flow simulation tool FS. The clustering results for this simulation are presented. These results show very positive with the Receiver Operating Curve (ROC) characteristics for the ART network anomaly detection algorithm COMMITTEE: Advisor: Christos Cassandras, SE/ECE; Ioannis Paschalidis, SE/ECE; David Starobinski, SE/ECE

Daniel Rossell, MS Candidate