RELIABLE INTRUSION DETECTION

RELIABLE INTRUSION DETECTION MAY BE ACHIEVED BY COMBINING GENERALIZED POTENTIAL FUNCTION (GPF) NEURAL NET CONSTRUCTION AND MULTIPLE SENSOR DATA FUSION. TRADITIONALLY, RELIABLE INTRUSION DETECTION CAN BE DIFFICULT BECAUSE NOISE LEVELS CHANGE WITH TIME AND LOCATION, AND AN INTRUSION MAY PRODUCE A WIDE RANGE OF SIGNALS OR VARIATIONS OVER THE DIFFERENT TYPES OF SENSORS. ACCOMMODATING THESE VARIATIONS IS NOT PRACTICAL USING STANDARD CLASSIFICATION TECHNIQUES. A SELF-ORGANIZING CLASSIFICATION TECHNIQUE, SUCH AS A NEURAL NET, PROVIDES A MEANS FOR LEARNING THE IDIOSYNCRASIES OF A PARTICULAR LOCATION AND FULLY UTILIZING DATA FROM VARIOUS INTRUSION DETECTION SENSORS (SEISMIC, ACOUSTIC, ELECTROMAGNETIC, TEMPERATURE, PRESSURE, ETC.). MANY METHODS OF NEURAL NET CONSTRUCTION HAVE BEEN DEVELOPED. MOST HAVE DEFICIENCIES FOR INTRUSION DETECTION. AN IMPRACTICAL NUMBER OF TRAINING INSTANCES MAY BE REQUIRED, OR THE CONFIDENCE OF DETECTION MAY NOT BE RELIABLY INDICATED. THE GPF METHOD OF NEURAL NET CONSTRUCTION HAS DEMONSTRATED A SUPERIOR ABILITY TO CHARACTERIZE COMPLEX CLASSES AND TO QUANTIFY THE CONFIDENCE OF CLASSIFICATION. THE PHASE I EFFORT WILL SET UP A TESTBED INCLUDING A VARIETY OF SENSORS, AND WILL MONITOR/RECORD ALL SENSOR OUTPUTS SIMULTANEOUSLY AS SIMULATED INTRUSIONS OCCUR. THE RECORDED DATA SET WILL BE USED TO TRAIN AND TEST THE GP NET INTRUSION DETECTION ALGORITHMIC FORMULATION. THE FALSE ALARM RATE AND PROBABILITY OF DETECTION WILL BE COMPARED TO THOSE OF THE INDIVIDUAL SENSORS, AND THIS APPROACH WILL BE OPTIMIZED FOR PHASE II. IN PHASE II, A FIELD TEST PROTOTYPE SYSTEM WILL BE DEVELOPED, INCORPORATING REAL-TIME TRAINING OF THE GP NET CLASSIFIER AND REAL-TIME INTRUSION DETECTION. THE PERFORMANCE OF THIS SYSTEM WILL BE EVALUATED USING SIMULATED INTRUSIONS. A PRODUCTION SYSTEM WILL BE PRODUCED AND INSTALLED DURING PHASE III