A hybrid network intrusion detection framework based on random forests and weighted k-means

Elbasiony, Reda; Sallam, Elsayed A.; Eltobely, Tarek E.; Fahmy, Mahmoud

doi:10.1016/j.asej.2013.01.003

Cited by 154 publications

(80 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Reda M. et al proposed two data-mining techniques [6] which are used in misuse, anomaly and hybrid detection. First off, the random forests algorithm is used as a data mining classification algorithm into a misuse detection method to build intrusion patterns from a balanced training dataset, and to seperate the captured network connections to the main types of intrusions due to the built patterns.…”

Section: Related Workmentioning

confidence: 99%

Intrusion Detection System based on SVM and Bee Colony

Gupta¹,

Shrivastava²

2015

IJCA

View full text Add to dashboard Cite

An intrusion detection system (IDS) is an active process or device that analyzes system and network activity for unauthorized entry. Nowadays many intrusion detection systems are developed based on many different machine learning techniques. Some of the models are based on single classifying techniques while some models are based on combining different classifying techniques, such as hybrid or ensemble techniques. The basic task is to classify network activities (in the network log as connection records) as normal or abnormal while minimizing misclassification. Even if different classification models have been developed for network intrusion detection, each classification technique has its vitality and vulnerability. The machine learning based SVM method is a good choice for learning with little volume of data. Whenever new information is added into a system, updating of the old model is required immediately to ensure that the system is properly protected. As retraining may take weeks, or even months, it is impractical to retrain the new model on all available data. Thus, a mechanism is needed to generate an adaptive model that can be updated by cooperation of the old model with the new information. We can take advantage of the clustering based on Bee Colony in updating the models. We propose a new approach of combining SVM and Bee Colony to achieve high quality performance of Intrusion Detection System. Our algorithm is implemented and evaluated using a standard benchmark KDD99 data set. In this paper experimental result shows that SVM with Bee colony achieves an average accuracy is 88.46%.

show abstract

Section: Related Workmentioning

confidence: 99%

Intrusion Detection System based on SVM and Bee Colony

Gupta¹,

Shrivastava²

2015

IJCA

View full text Add to dashboard Cite

show abstract

“…In [13] random forests and weighted K-means were used to form a hybrid learning approach. Based on the experimental results, the authors showed that the misuse detection based on the random forest has high detection rate and high false alarm rate.…”

Section: Combination Of K-means and A Classifiermentioning

confidence: 99%

KCMC: A Hybrid Learning Approach for Network Intrusion Detection using K-means Clustering and Multiple Classifiers

Farrahi¹,

Ahmadzadeh²

2015

IJCA

View full text Add to dashboard Cite

A network Intrusion Detection System (IDS) is a security tool that acts as a defensive line. One of the most important challenges in network intrusion detection research area is designing an accurate intrusion detection system in terms of high detection rate, high accuracy and low false alarm rate. Hybrid learning approaches employ to deal with this challenge since, they have promising results in terms of detection rate, accuracy and false alarm rate. This paper, proposed a general structure of a hybrid learning approach. Then, the proposed approach has been implemented using Kmeans Clustering and Multiple Classifiers (KCMC). The data have been partitioned based on K-means clustering algorithm. Then, each partition classified using a distinct classifier. Naïve Bayes, Support Vector Machines and OneR classification algorithms have been used as the classifiers. The proposed hybrid approach has better results comparing to single classifiers in terms of detection rate, accuracy and false alarm rate. The detection rate of the proposed hybrid learning approach is 99.50%.

show abstract

“…(Hu, Li, Xie, & Hu, 2015). (Elbasiony, Sallam, Eltobely, & Fahmy, 2013) Used weighted K-means and Random Forest classification, the experiment worked very well except that KDD CUP99 dataset was used and the results were 98.3% Detection Rate and 1.6% false alarm rate. (Yassin, Udzir, & Muda, 2013) Proposed integrated machine algorithms and Naïve Bayes to minimize false alarm rate and improve accuracy rate.…”

Section: Introductionmentioning

confidence: 99%