A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM

Abstract

A pattern matching method (signature-based) is widely used in basic network intrusion detection systems (IDS). A more robust method is to use a machine learning classifier to detect anomalies and unseen attacks. However, a single machine learning classifier is unlikely to be able to accurately detect all types of attacks, especially uncommon attacks e.g., Remote2Local (R2L) and User2Root (U2R) due to a large difference in the patterns of attacks. Thus, a hybrid approach offers more promising performance. In this paper, we proposed a Double-Layered Hybrid Approach (DLHA) designed specifically to address the aforementioned problem. We studied common characteristics of different attack categories by creating Principal Component Analysis (PCA) variables that maximize variance from each attack type, and found that R2L and U2R attacks have similar behaviour to normal users. DLHA deploys Naive Bayes classifier as Layer 1 to detect DOS and Probe, and adopts SVM as Layer 2 to distinguish R2L and U2R from normal instances. We compared our work with other published research articles using the NSL-KDD data set. The experimental results suggest that DLHA outperforms several existing state-of-the-art IDS techniques, and is significantly better than any single machine learning classifier by large margins. DLHA also displays an outstanding performance in detecting rare attacks by obtaining a detection rate of 96.67% and 100% from R2L and U2R respectively.

Detection of unique delete attack in wireless sensor network using gradient thresholding‐long short‐term memory algorithm

“…GT‐LSTM method has better accuracy, precision, recall and F‐measure indicators than other algorithms and compared with SVM as Layer 2 to distinguish R2L and U2R from normal instances 34 . CNN is compared with GT‐LSTM for network attacks and real time dataset is used 35 .…”

“…to distinguish R2L and U2R from normal instances. 34 CNN is compared with GT-LSTM for network attacks and real time dataset is used. 35 Auto encoder (AE) is applied for intrusion detection (IDS) system and compared with GT-LSTM.…”

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data

“…Compared w CNN, the proposed model used CNN to first extract feature information and the sign the weights of channels by using the attention mechanism, and finally, learn lationship between features in the network traffic by Bi-LSTM, thereby achieving proved classification performance. [28] 87.55 88.16 90.14 89 BAT-MC [14] 84.25 --Autoencoder [29] 84.24 87.00 80.37 81 CNN [30] 80.13 --Adaptive Ensemble [31] 85.20 86.50 86.50 85 TES-IDS [32] 85.79 88.00 86.80 87 GAR-Forest [33] 85.06 87.50 85.10 85 CNN+BiLSTM [34] 83.58 85.82 84.49 85 NB Tree [5] 82.02 --SVM-IDS [35] 82.37 --…”

A Fast and Effective Method for Intrusion Detection using Multi-Layered Deep Learning Networks

“…An earlier version of this model that deals with the detection of intrusions on systems that have been implanted was proposed [16]. The study [17] presents a proposal for a staggered intrusion detection paradigm that is based on peculiarity detection. A comparable methodology for the detection of peculiarities based on trees was suggested [18].…”