Identifying Significant Features for Network Forensic Analysis Using Artificial Intelligence Techniques.

摘要: Network forensics is the study of analyzing network activity in order to discover source security policy violations or information assurance breaches. Capturing for forensic analysis simple theory, but relatively trivial practice. Not all captured recorded will be useful analysis. Identifying key features that reveal deemed worthy further intelligent a problem great interest researchers field. The focus this paper use artificial techniques offline intrusion analysis, protect integrity and confidentiality infrastructure. An effective tool essential ensuring by updating newly identified breaches organizations protection detection mechanisms. Two are studied: Artificial Neural Networks (ANNs) Support Vector Machines (SVMs). We show SVMs superior ANNs three critical respects: 1. train, run an magnitude faster; 2. scale much better; 3. give higher classification accuracy. also address related issue ranking importance input features, which modeling. Since elimination insignificant and/or useless inputs leads simplification may allow faster more accurate detection, feature selection very important forensics. methods presented; first one independent modeling tool, while second method specific SVMs. two applied identify 1999 DARPA data. It shown produce results largely consistent.