Hierarchical Core Vector Machines for Network Intrusion Detection
For labelling network intrusions as they state hierarchical multi-label structure, we develop a hierarchical core vector machines (HCVM) algorithm for high-speed network intrusion detection via hierarchical multi-label classification of network data. HCVM models a multi-label hierarchy into a data Hyper-Sphere constructed by numbers of core vector machines (CVM). As the CVMs in an HCVM are separating, encompassing and overlapping with each other, which forms naturally a tree structure representing the multi-label hierarchy encoded. Provided an unlabelled sample, the HCVM seeks a CVM enclosing the sample, and multiply label the sample according to the MEB’s position in the hierarchy. The proposed HCVM method has been examined on KDD’99 and the result shows that the proposed HCVM has significant improvement over previously published benchmark works. HCVM improves U2R accuracy from 13.2% to 82.7% and R2L from 8.4% to 45.9%, as compared to the winner of KDD’99. In particular, the efficiency of HCVM is highlighted, as the computational time stays steady while the size of training data exponentially manifolds.
Unable to display preview. Download preview PDF.
- 2.Ye, N., Chen, Q.: An anomaly detection technique based on a chi-square statistic for detecting intrusions into information systems. International 17, 105–112 (2001)Google Scholar
- 3.Mukkamala, S., Sung, A.H.: Identifying significant features for network forensic analysis using artificial intelligent techniques. Intl. Journal of Digital Evidence 1, 2003 (2003)Google Scholar
- 4.Frank, J., Mda-c, N.U.: Artificial intelligence and intrusion detection: Current and future directions. In: Proceedings of the 17th National Computer Security Conference (1994)Google Scholar
- 5.Panda, M., Patra, M.R.: Network intrusion detection using naive bayes. International journal of computer science and network security, 258–263 (2007)Google Scholar
- 6.Staff, C.: Hackers: companies encounter rise of cyber extortion. Computer Crime Research Center 2006 (2005)Google Scholar
- 7.CSI, FBI: Proceedings of the 10th annual computer crime and security survey, vol. 10, pp. 1–23 (2005)Google Scholar
- 8.Tsoumakas, G., Katakis, I.: Multi-label classification: An overview. International Journal of Data Warehousing and Mining 3(3), 1–12 (2007)Google Scholar
- 11.Badoiu, M., Clarkson, K.: Optimal core sets for balls. In: DIMACS Workshop on Computational Geometry (2002)Google Scholar
- 14.Hendrik, B., Leander, S., Jan, S., Amanda, C.: Decision trees for hierarchical multilabel classification: A case study in functional genomics. Journal of Machine Learning Research 4213, 18–29 (2006)Google Scholar
- 15.KDD 1999 (1999), http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html