Fuzzy feature extraction and visualization for intrusion detection

The Fuzzy Intrusion Recognition Engine (FIRE) is a network intrusion detection system that uses fuzzy systems to assess malicious activity against computer networks. A key part of an intrusion detection system is the selection of key features that can characterize the state of the network. This work uses interactive data visualization to analyze the features of several different intrusion detection scenarios using the DARPA Lincoln Labs test data. Visualizing the data helps to characterize which features are key for identifying intrusions and if they can be characterized as fuzzy sets or by Boolean variables. These inputs can then be input into a fuzzy cognitive map that serves to fuse the inputs to detect more complex attacks.