A Time Series Data Mining Based on ARMA and MLFNN Model for Intrusion Detection

This paper investigates the issue on how to effectively model time series with a new algorithm given by a Multilayer Feedforward Neural Network (MLFNN) and an Autoregressive Moving Average (ARMA). The static nonlinear part is modeled by MLFNN, and the linear part is modeled by an ARMA model. The algorithm is developed for estimating the weights of the MLFNN and the parameters of ARMA model. To illustrate the feasibility and simplicity of the above procedures for time series data mining, the problem of measuring normality in HTTP traffic for the purpose of anomaly-based network intrusion detection is addressed. The detection results provided by the approach of this paper show important improvements, both in detection ratio and regarding false alarms, in comparison with those obtained using other current techniques. Simulation examples are included to illustrate the performance of the proposed method.