Hierarchical Core Vector Machines for Network Intrusion Detection

  • Ye Chen
  • Shaoning Pang
  • Nikola Kasabov
  • Tao Ban
  • Youki Kadobayashi
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5864)

Abstract

For labelling network intrusions as they state hierarchical multi-label structure, we develop a hierarchical core vector machines (HCVM) algorithm for high-speed network intrusion detection via hierarchical multi-label classification of network data. HCVM models a multi-label hierarchy into a data Hyper-Sphere constructed by numbers of core vector machines (CVM). As the CVMs in an HCVM are separating, encompassing and overlapping with each other, which forms naturally a tree structure representing the multi-label hierarchy encoded. Provided an unlabelled sample, the HCVM seeks a CVM enclosing the sample, and multiply label the sample according to the MEB’s position in the hierarchy. The proposed HCVM method has been examined on KDD’99 and the result shows that the proposed HCVM has significant improvement over previously published benchmark works. HCVM improves U2R accuracy from 13.2% to 82.7% and R2L from 8.4% to 45.9%, as compared to the winner of KDD’99. In particular, the efficiency of HCVM is highlighted, as the computational time stays steady while the size of training data exponentially manifolds.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Chirita, P.A., Diederich, J., Nejdl, W.: Mailrank: using ranking for spam detection. In: CIKM 2005: Proceedings of the 14th ACM international conference on Information and knowledge management, pp. 373–380. ACM, New York (2005)CrossRefGoogle Scholar
  2. 2.
    Ye, N., Chen, Q.: An anomaly detection technique based on a chi-square statistic for detecting intrusions into information systems. International 17, 105–112 (2001)Google Scholar
  3. 3.
    Mukkamala, S., Sung, A.H.: Identifying significant features for network forensic analysis using artificial intelligent techniques. Intl. Journal of Digital Evidence 1, 2003 (2003)Google Scholar
  4. 4.
    Frank, J., Mda-c, N.U.: Artificial intelligence and intrusion detection: Current and future directions. In: Proceedings of the 17th National Computer Security Conference (1994)Google Scholar
  5. 5.
    Panda, M., Patra, M.R.: Network intrusion detection using naive bayes. International journal of computer science and network security, 258–263 (2007)Google Scholar
  6. 6.
    Staff, C.: Hackers: companies encounter rise of cyber extortion. Computer Crime Research Center 2006 (2005)Google Scholar
  7. 7.
    CSI, FBI: Proceedings of the 10th annual computer crime and security survey, vol. 10, pp. 1–23 (2005)Google Scholar
  8. 8.
    Tsoumakas, G., Katakis, I.: Multi-label classification: An overview. International Journal of Data Warehousing and Mining 3(3), 1–12 (2007)Google Scholar
  9. 9.
    Boutell, M.R.: Learning multi-label scene classification. Pattern Recognition 37(9), 1757–1771 (2004)CrossRefGoogle Scholar
  10. 10.
    Welzl, E.: Smallest enclosing disks (balls and ellipsoids). In: Maurer, H.A. (ed.) New Results and New Trends in Computer Science. LNCS, vol. 555, pp. 359–370. Springer, Heidelberg (1991)CrossRefGoogle Scholar
  11. 11.
    Badoiu, M., Clarkson, K.: Optimal core sets for balls. In: DIMACS Workshop on Computational Geometry (2002)Google Scholar
  12. 12.
    Kumar, P., Mitchell, J.S.B., Yildirim, E.A.: Approximate minimum enclosing balls in high dimensions using core-sets. J. Exp. Algorithmics 8, 1.1 (2003)CrossRefMathSciNetGoogle Scholar
  13. 13.
    Tsang, I.W., Kwok, J.T., Cheung, P.-M.: Core vector machines: Fast svm training on very large data sets. Journal of Machine Learning Research 6, 363–392 (2005)MathSciNetGoogle Scholar
  14. 14.
    Hendrik, B., Leander, S., Jan, S., Amanda, C.: Decision trees for hierarchical multilabel classification: A case study in functional genomics. Journal of Machine Learning Research 4213, 18–29 (2006)Google Scholar
  15. 15.

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Ye Chen
    • 1
  • Shaoning Pang
    • 1
  • Nikola Kasabov
    • 1
  • Tao Ban
    • 2
  • Youki Kadobayashi
    • 2
  1. 1.Knowledge Engineering & Discover Research InstituteAuckland University of TechnologyAucklandNew Zealand
  2. 2.Information Security Research CenterNational Institute of Information and Communications TechnologyTokyoJapan

Personalised recommendations