Approach Based Ensemble Methods for Better and Faster Intrusion Detection

  • Emna Bahri
  • Nouria Harbi
  • Hoa Nguyen Huu
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6694)


This study introduces a new method based on Greedy-Boost, a multiple classifier system, for better and faster intrusion detection. Detection of the anomalies in the data-processing networks is regarded as a problem of data classification allowing to use data mining and machine learning techniques to perform intrusion detection. With such automatic processing procedures, human expertise only focuses on a small set of potential anomalies which may result in important time savings and efficiency. In order to be scalable and efficient, these kinds of approaches must respect important requirements. The first is to obtain a high level of precision, that is to be able to detect a maximum of anomalies with a minimum of false alarms. The second is to detect potential anomalies as fast as possible. We propose Greedy-Boost, a new approach of boosting which is based on an adaptive combination of multiple classifiers to perform the precision of the detection. This approach uses an aspect of smooth that ensures stability of the classifier system and offers speed of detection. The experimental results, conducted on the KDD99 dataset, prove that our proposed approach outperforms several state-of-the-art methods, particularly in detecting rare attack types.


Ensemble methods boosting data mining intrusion detection systems Greedy-Boost 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Xiang, C., Yong, P.C., Meng, L.S.: Design of multiple-level hybrid classifier for intrusion detection system using Bayesian clustering and decision trees. Pattern Recognition Letters 29 (2008)Google Scholar
  2. 2.
    Giacinto, G., Roli, F.: Intrusion detection in computer networks by multiple classifier systems. In: 16th International Conference on Pattern Recognition, Quebec City, Canada (2003)Google Scholar
  3. 3.
    Zainal, A., Maarof, M.A., Shamsuddin, S.M., Abraham, A.: Ensemble of one-class classifiers for network intrusion detection system. In: Information Assurance and Security (2008)Google Scholar
  4. 4.
    Perdisci, R., Ariu, D., Fogla, P., Giacinto, G., Lee, W.: McPAD: A multiple classifier system for accurate payload based anomaly detection. Computer Networks 53(6), 864–881 (2009)CrossRefzbMATHGoogle Scholar
  5. 5.
    Giacinto, G., Perdisci, R., Rio, M.D., Roli, F.: Intrusion detection in computer networks by a modular ensemble of one-class classifiers. Information Fusion 9, 69–82 (2008)CrossRefGoogle Scholar
  6. 6.
    Giacinto, G., Perdisci, R., Roli, F.: Network Intrusion Detection by Combining One-class Classifiers. In: International Conference on Image Analysis and Processing (2005); Special Session on Intrusion Detection, ICIAP Google Scholar
  7. 7.
    Abadeh, M.S., Habibi, J., Barzegar, Z., Sergi, M.: A parallel genetic local search algorithm for intrusion detection in computer networks. In: Engineering Applications of Artificial Intelligence, vol. 20, pp. 1058–1069 (2007)Google Scholar
  8. 8.
    Mukkamala, S., Sung, A.H., Abraham, A.: Intrusion detection using an ensemble of intelligent paradigms. Network and Computer Applications 28, 167–182 (2005)CrossRefGoogle Scholar
  9. 9.
    Zhang, J., Zulkernine, M.: Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection. In: IEEE International Conference on Communications, ICC 2006, pp. 2388–2393 (2006)Google Scholar
  10. 10.
  11. 11.
    Shapire, R.: The strength of weak learnability. Machine Learning 5, 197–227 (1990)Google Scholar
  12. 12.
    Freund, Y., Schapire, R.E.: A decision-theoretic generalization of on-line learning and an application to Boosting. J. Comput. Syst. Sci. 55(1), 119–139 (1997)MathSciNetCrossRefzbMATHGoogle Scholar
  13. 13.
    Shafi, K., Abbass, H.A.: An adaptive genetic-based signature learning system for intrusion detection. Expert Systems with Applications 36(10), 12036–12043 (2009)CrossRefGoogle Scholar
  14. 14.
    Jiang, S.Y., Song, X., Wang, H., Han, J.J., Li, Q.H.: A clustering-based method for unsupervised intrusion detections. Pattern Recognition Letters 27, 802–810 (2006)CrossRefGoogle Scholar
  15. 15.
    Yu, Z., Tsai, J.J.P.: An efficient intrusion detection system using a boosting-based learning algorithm. International Journal of Computer Applications in Technology Achive 27(4) (2006)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Emna Bahri
    • 1
  • Nouria Harbi
    • 1
  • Hoa Nguyen Huu
    • 1
  1. 1.ERIC LaboratoryUniversity of LyonFrance

Personalised recommendations