Accelerating Anomaly-Based IDS Using Neural Network on GPU

Recently, anomaly-based intrusion detection system (IDS) is valuable methodology to protect target systems and networks against attacks. Modeling normal system/network behaviors enables anomaly-based IDS (Intrusion Detection System) to be extremely effective methodology to detect both known as well as unknown/new attacks. However, current software-based methods are difficult to process a large amount of data in anomaly-based IDSs and cannot keep up the high-link speeds. The implementations of anomaly-based IDSs on parallel processing platforms are considered as necessary to accelerate speed of the systems. Neural Networks are a good example of parallel computing. In this paper, we used Neural Network technology to classify normal or abnormal behaviors. The parallel nature of Neural Networks has been implemented on GPUs that allows the system to meet a set of requirements such as time constraints management, robustness, high processing speed and re-configurability. Experiments with KDD Cup 1999 network traffic connections which have been preprocessed with methods of features selection and normalization have shown that our work is effective to accelerate intrusion detection in anomaly-based IDS. The result shows that our implementation on GPU is much faster than the implementation on CPU up to 32x.