A multi-layer perceptron approach for flow-based anomaly detection

The increase in successful cyber-attacks on systems with firewalls and encryption techniques has led to the creation of Intrusion Detection Systems (IDS). Machine learning techniques are often used for these systems to predict malicious behaviour in the vague and unbalanced data. Flow-based IDS monitors only the packet headers of the network traffic and not the attached data to keep up with the growing bandwidth of networks and to maintain the privacy of the users. In this context, a multilayer perceptron approach is analysed on two different datasets and compared to a J48 Decision Tree classifier. Obtained results confirm that flow-based systems seem to be, apart from inevitable, the right way for IDS in the future and that MLP can still be useful in flow-based detection.