Intrusion Detection with Comparative Analysis of Supervised Learning Techniques and Fisher Score Feature Selection Algorithm

  • Doğukan AksuEmail author
  • Serpil Üstebay
  • Muhammed Ali Aydin
  • Tülin Atmaca
Conference paper
Part of the Communications in Computer and Information Science book series (CCIS, volume 935)


Rapid development of technologies not only makes life easier, but also reveals a lot of security problems. Developing and changing of attack types affect many people, organizations, companies etc. Therefore, intrusion detection systems have been developed to avoid financial and emotional loses. In this paper, we used CICIDS2017 dataset which consist of benign and the most cutting-edge common attacks. Best features are selected by using Fisher Score algorithm. Real world data extracted from the dataset are classified as DDoS or benign with using Support Vector Machine (SVM), K Nearest Neighbour (KNN) and Decision Tree (DT) algorithms. As a result of the study, 0,9997%, 0,5776%, 0,99% success rates were achieved respectively.


IDS Machine learning CICIDS2017 



This work is also a part of the M.Sc. thesis titled Performance Analysis of Log Based Intrusion Detection Systems Istanbul University, Institute of Physical Sciences.


  1. 1.
    Ibrahimi, K., Ouaddane, M.: Management of intrusion detection systems based-KDD99: analysis with LDA and PCA. In: 2017 International Conference on Wireless Networks and Mobile Communications (WINCOM), pp. 1–6. IEEE (2017)Google Scholar
  2. 2.
    Moustafa, N., Slay, J.: The significant features of the UNSW-NB15 and the KDD99 data sets for network intrusion detection systems. In: 2015 4th International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS), pp. 25–31. IEEE (2015)Google Scholar
  3. 3.
    Sun, L., Anthony, T.S., Xia, H.Z., Chen, J., Huang, X., Zhang, Y.: Detection and classification of malicious patterns in network traffic using Benford’s law. In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), pp. 864–872. IEEE (2017)Google Scholar
  4. 4.
    Almansob, S.M., Lomte, S.S.: Addressing challenges for intrusion detection system using naive Bayes and PCA algorithm. In: 2017 2nd International Conference for Convergence in Technology (I2CT), pp. 565–568. IEEE (2017)Google Scholar
  5. 5.
    Raja, M.C., Rabbani, M.M.A.: Combined analysis of support vector machine and principle component analysis for IDS. In: IEEE International Conference on Communication and Electronics Systems, pp. 1–5 (2016)Google Scholar
  6. 6.
    UNB Canadian Cyber Security, Intrusion Detection Evaluation Dataset (CICIDS2017).
  7. 7.
    Lunt, T.F.: Automated audit trail analysis and intrusion detection: a survey. In Proceedings of the 11th National Computer Security Conference, vol. 353 (1988)Google Scholar
  8. 8.
    Denning, D.E.: An intrusion-detection model. IEEE Trans. Softw. Eng. 2, 222–232 (1987)CrossRefGoogle Scholar
  9. 9.
    Crosbie, M., Spafford, E.H.: Defending a computer system using autonomous agents (1995) Google Scholar
  10. 10.
    Endler, D.: Intrusion detection. Applying machine learning to Solaris audit data. In: 1998 Proceedings of 14th Annual Computer Security Applications Conference, pp. 268–279. IEEE (1998)Google Scholar
  11. 11.
    Patcha, A., Park, J.M.: An overview of anomaly detection techniques: existing solutions and latest technological trends. Comput. Netw. 51(12), 3448–3470 (2007)CrossRefGoogle Scholar
  12. 12.
    Cover, T., Hart, P.: Nearest neighbor pattern classification. IEEE Trans. Inf. Theory 13(1), 21–27 (1967)CrossRefGoogle Scholar
  13. 13.
    Cortes, C., Vapnik, V.: Support-vector networks. Mach. Learn. 20(3), 273–297 (1995)zbMATHGoogle Scholar
  14. 14.
    Gu, Q., Li, Z., Han, J.: Generalized fisher score for feature selection (2012). arXiv preprint arXiv:1202.3725

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  • Doğukan Aksu
    • 1
    Email author
  • Serpil Üstebay
    • 2
  • Muhammed Ali Aydin
    • 1
  • Tülin Atmaca
    • 3
  1. 1.Istanbul UniversityIstanbulTurkey
  2. 2.Istanbul Medeniyet UniversityIstanbulTurkey
  3. 3.Laboratories Samovar, Telecom-SudParisUniversité Paris-SaclayParisFrance

Personalised recommendations