A distance sum-based hybrid method for intrusion detection

Guo, Chun; Zhou, Yiming; Ping, Yuan; Zhang, Zhongkun; Liu, Guole; Yang, Yixian

doi:10.1007/s10489-013-0452-6

Cited by 60 publications

(23 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As the results shows, the finding of this study, using the most used machine learning methods, the full data set, and comparing the classifiers with respect to binary and hardware criteria, can be a reference study for further studies in IDS or similar large datasets. (Zeng et al, 2011;Gowrison et al, 2013) BayesNet (Nguyen and Choi, 2008) MLP (Gowrison et al, 2013;Sheikhan and Sharifi Rad, 2013) OneR (Nguyen and Choi, 2008) Decision Tree (Nguyen and Choi, 2008;Sindhu et al, 2012;Guo et al, 2014;Khor et al, 2012;Lin et al, 2012;Benferhat et al, 2013) Decision Table (Nguyen and Choi, 2008) RBF Naive Bayes (Guo et al, 2014;Nguyen and Choi, 2008;Zeng et al, 2011;Benferhat et al, 2013) Decision Tree (Nguyen and Choi, 2008;Sindhu et al, 2012;Guo et al, 2014;Khor et al, 2012;Lin et al, 2012;Benferhat et al, 2013) SVM (Chung and Wahid, 2012;Lin et al, 2012;Guo et al, 2014) Random Forest (Zhang et al, 2008;Sindhu et al, 2012) Logistic Regression (Nguyen and Choi, 2008) NA 0.9999 ↑ 0.9470 ↑ J48 0.9885 (Lin et al, 2012) 0.9401 (Benferhat et al, 2013) 1.0000 ↑ 0.9349 ↓ Logistic Regression NA NA 0.9948 0.8152 MLP 0.9390…”

Section: Resultsmentioning

confidence: 99%

The impact of using large training data set KDD99 on classification accuracy

Özgür

Erdem

2017

Preprint

View full text Add to dashboard Cite

(10) Radial Basis Function Neural Networks, (11) Support Vector Machines (two different training algorithms), and (12) ZeroR. A well-known IDS benchmark dataset, KDD99 has been used to train and test classifiers. Full training data set of KDD99 is 4.9 million instances while full test dataset is 311,000 instances. In contrast to similar previous studies, which used 0.08%-10% for training and 1.2%-100% for testing, this study uses full training dataset and full test dataset. Weka Machine Learning Toolbox has been used for modeling and simulation. The performance of classifiers has been evaluated using This study investigates the effects of using a large data set on supervised machine learning classifiers in the domain of Intrusion Detection Systems (IDS). To investigate this effect 12 machine learning algorithms have been applied. These algorithms are: (1) Adaboost, (2) Bayesian Nets, (3) Decision Tables, (4) Decision Trees (J48), (5)Logistic Regression, (6) Multi-Layer Perceptron, (7) Naive Bayes, (8) OneRule, (9)Random Forests, (10) Radial Basis Function Neural Networks, (11) Support Vector Machines (two different training algorithms), and (12) ZeroR. A well-known IDS benchmark dataset, KDD99 has been used to train and test classifiers. Full training data set of KDD99 is 4.9 million instances while full test dataset is 311,000 instances. In contrast to similar previous studies, which used 0.08%-10% for training and 1.2%-100% for testing, this study uses full training dataset and full test dataset. Weka Machine Learning Toolbox has been used for modeling and simulation. The performance of classifiers has been evaluated using standard binary performance metrics: Detection Rate, True Positive Rate, True Negative Rate, False Positive Rate, False Negative Rate, Precision, and F1-Rate. To show effects of dataset size, performance of classifiers has been also evaluated using following hardware metrics: Training Time, Working Memory and Model Size. Test results shows improvements in classifiers in standard performance metrics compared to previous studies.

show abstract

Section: Resultsmentioning

confidence: 99%

The impact of using large training data set KDD99 on classification accuracy

Özgür

Erdem

2017

Preprint

View full text Add to dashboard Cite

show abstract

“…In some cases, there is considerable divergence from one test to another one. The obvious case is SVM, which incurred a training time of 267.22 s in and 4.231 s in . Therefore, this comparison is provided in Table just for reference.…”

Section: Resultsmentioning

confidence: 99%

“…Khor et al , proposed a hybrid classifier by cascading different machine learning techniques such as the Bayesian networks and C4.5 decision tree. Guo et al , proposed a hybrid learning method, named distance sum‐based SVM (DSSVM). In DSSVM, a distance sum is defined as a correlation between each data sample and cluster centers.…”

Section: Related Workmentioning

confidence: 99%

Multivariate correlation analysis and geometric linear similarity for real‐time intrusion detection systems

Derhab

Bouras

2014

Security Comm Networks

View full text Add to dashboard Cite

In this paper, we propose an intrusion detection system (IDS) based on four approaches: (i) statistical‐based IDS to reduce detection time; (ii) intertwining data acquisition phase and data preprocessing phase to ensure real‐time detection; (iii) geometric linear similarity measure that improves detection accuracy compared with existing measures; and (iv) multivariate correlation analysis that extracts a subset of strongly correlated features to construct a normal behavioral graph. Based on this graph, we derive the normal profile composed of high‐level features. We use NSL‐KDD dataset to analyze and evaluate the efficiency of the proposed IDS at detecting denial‐of‐service (DOS) attacks. Experimental results show that the proposed IDS can achieve good results in terms of detection rate and false positive rate. For some DOS attacks, 100% detection rate is achieved with 1.55% false positive. We also use KDD99 dataset to compare the proposed IDS with two statistical‐based methods and some data mining and machine learning‐based methods. Comparison study shows that the proposed IDS achieves the best tradeoff between detection rate (99.76%) and false positive rate (0.6%). It also requires just a few microseconds to classify the connection as normal or attack with low CPU usage and low memory consumption. Copyright © 2014 John Wiley & Sons, Ltd.

show abstract

“…P2P traffic is a collection of 9206 flows' features that were extracted from traffic supplied by UNIBS [37] following the method of Peng et al [38]. Following the work of Guo et al [39], kddcup99 is a nine-dimensional dataset extracted from KDD Cup 1999 Data [40], which was used to build a network intrusion detector. Due to space limitation, thereafter, we use abbreviations in brackets for dataset with long name.…”

Section: Methodsmentioning

confidence: 99%

Maximized Privacy-Preserving Outsourcing on Support Vector Clustering

et al. 2020

Self Cite

View full text Add to dashboard Cite

Despite its remarkable capability in handling arbitrary cluster shapes, support vector clustering (SVC) suffers from pricey storage of kernel matrix and costly computations. Outsourcing data or function on demand is intuitively expected, yet it raises a great violation of privacy. We propose maximized privacy-preserving outsourcing on SVC (MPPSVC), which, to the best of our knowledge, is the first all-phase outsourceable solution. For privacy-preserving, we exploit the properties of homomorphic encryption and secure two-party computation. To break through the operation limitation, we propose a reformative SVC with elementary operations (RSVC-EO, the core of MPPSVC), in which a series of designs make selective outsourcing phase possible. In the training phase, we develop a dual coordinate descent solver, which avoids interactions before getting the encrypted coefficient vector. In the labeling phase, we design a fresh convex decomposition cluster labeling, by which no iteration is required by convex decomposition and no sampling checks exist in connectivity analysis. Afterward, we customize secure protocols to match these operations for essential interactions in the encrypted domain. Considering the privacy-preserving property and efficiency in a semi-honest environment, we proved MPPSVC's robustness against adversarial attacks. Our experimental results confirm that MPPSVC achieves comparable accuracies to RSVC-EO, which outperforms the state-of-the-art variants of SVC.

show abstract

A distance sum-based hybrid method for intrusion detection

Cited by 60 publications

References 30 publications

The impact of using large training data set KDD99 on classification accuracy

The impact of using large training data set KDD99 on classification accuracy

Multivariate correlation analysis and geometric linear similarity for real‐time intrusion detection systems

Maximized Privacy-Preserving Outsourcing on Support Vector Clustering

Contact Info

Product

Resources

About