Dynamic response recognition by neural network to detect network host anomaly activity

A problem of anomaly behavior detection for network communicating computer is discussed. A novel approach based on dynamic response of computer is introduced. The computer is suggested as a multiple-input multiple-output (MIMO) plant. To characterize dynamic response of the computer on incoming requests a correlation between input data rate and observed output response (outgoing data rate and performance metrics) is used. To distinguish normal and anomaly behavior of the computer a one-class classifier based on feedforward neural network is constructed. In the paper a method of anomaly detection is described and results of model experiments with Web-server are provided.