A DOS and network probe attack detection based on HMM using fuzzy inference

This paper aims to provide an intrusion detection system for network traffic that achieves to the low false positive rate with having high attack detection rate. This system will identify anomalies by monitoring network traffic. So, Features extracted from the network traffic by the number of HMM, are modeled as a Classifier ensemble. Then by integrating the outputs of the HMM within a group, probability value is generated. In this system each feature receives a weight and rather than a threshold value, using the fuzzy inference to decide between normal and abnormal network traffic. So at first, the fuzzy rules of decide module are formed manually and based on the value of the security of extraction feature. Then probability output of each HMM groups converted to fuzzy values according to fuzzy rules. These values are applied by a fuzzy inference engine and converted to an output indicating the being normal or abnormal of network traffic. Experiments show that the proposed system in detecting attacks that are the main candidate error is working well. Also, measures recall, precision and F1-measure respectively with 100%, 99.38% and 99.69% will pass. Finally, attack detection rate close to 100% and false positive rate of 0.62%, showing that the proposed system is improved compared to previous systems.