Approach Based Ensemble Methods for Better and Faster Intrusion Detection
This study introduces a new method based on Greedy-Boost, a multiple classifier system, for better and faster intrusion detection. Detection of the anomalies in the data-processing networks is regarded as a problem of data classification allowing to use data mining and machine learning techniques to perform intrusion detection. With such automatic processing procedures, human expertise only focuses on a small set of potential anomalies which may result in important time savings and efficiency. In order to be scalable and efficient, these kinds of approaches must respect important requirements. The first is to obtain a high level of precision, that is to be able to detect a maximum of anomalies with a minimum of false alarms. The second is to detect potential anomalies as fast as possible. We propose Greedy-Boost, a new approach of boosting which is based on an adaptive combination of multiple classifiers to perform the precision of the detection. This approach uses an aspect of smooth that ensures stability of the classifier system and offers speed of detection. The experimental results, conducted on the KDD99 dataset, prove that our proposed approach outperforms several state-of-the-art methods, particularly in detecting rare attack types.
KeywordsEnsemble methods boosting data mining intrusion detection systems Greedy-Boost
Unable to display preview. Download preview PDF.
- 1.Xiang, C., Yong, P.C., Meng, L.S.: Design of multiple-level hybrid classifier for intrusion detection system using Bayesian clustering and decision trees. Pattern Recognition Letters 29 (2008)Google Scholar
- 2.Giacinto, G., Roli, F.: Intrusion detection in computer networks by multiple classifier systems. In: 16th International Conference on Pattern Recognition, Quebec City, Canada (2003)Google Scholar
- 3.Zainal, A., Maarof, M.A., Shamsuddin, S.M., Abraham, A.: Ensemble of one-class classifiers for network intrusion detection system. In: Information Assurance and Security (2008)Google Scholar
- 6.Giacinto, G., Perdisci, R., Roli, F.: Network Intrusion Detection by Combining One-class Classifiers. In: International Conference on Image Analysis and Processing (2005); Special Session on Intrusion Detection, ICIAP Google Scholar
- 7.Abadeh, M.S., Habibi, J., Barzegar, Z., Sergi, M.: A parallel genetic local search algorithm for intrusion detection in computer networks. In: Engineering Applications of Artificial Intelligence, vol. 20, pp. 1058–1069 (2007)Google Scholar
- 9.Zhang, J., Zulkernine, M.: Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection. In: IEEE International Conference on Communications, ICC 2006, pp. 2388–2393 (2006)Google Scholar
- 11.Shapire, R.: The strength of weak learnability. Machine Learning 5, 197–227 (1990)Google Scholar
- 15.Yu, Z., Tsai, J.J.P.: An efficient intrusion detection system using a boosting-based learning algorithm. International Journal of Computer Applications in Technology Achive 27(4) (2006)Google Scholar