Predicting intrusions with local linear models

Intrusion Detection Systems are typically deployed for real time operation, but are limited to identifying attacks once initiated. In this work we instead investigate the potential for predicting an attack before it occurs. To do so, a two-stage process is employed with a classification stage following that of a predictor. Predictors are based on the SOM and classifier on an SVM. Training and test is conducted using the ´TCP´ connection features from the DARPA KDD competition data set. In spite of the simplicity of the model, the system is able to provide false positive and false negative rates of 23.8% and 7.1% respectively for one step-ahead prediction.