A Support Vector Machine Cost Function in Simulated Annealing for Network Intrusion Detection

Abstract

This paper proposes a computationally intelligent algorithm for extracting relevant features from a training set. An optimal subset of features is extracted from training examples of network intrusion datasets. The Support Vector Machine (SVM) algorithm is used as the cost function within the thermal equilibrium loop of the Simulated Annealing (SA) algorithm. The proposed fusion algorithm uses a combinatorial optimization algorithm (SA) to determine an optimal feature subset for a classifier (SVM) for the classification of normal and abnormal packets (possible intrusion threats) in a network. The proposed methodology is analyzed and validated using two different network intrusion datasets and the performance measures used are; detection accuracy, false positive and false negative rate, Receiver Operation Characteristics (ROC) curve, area under curve value and F1-score. A comparative analysis through empirically determined measures show that the proposed SA-SVM based model outperforms the general SVM and decision tree-based detection schemes based on performance measures such as detection accuracy, false positive and false negative rates, area under curve value and F1-score.

A Detailed Analysis of the Multi-Class Classification Problem in Network Intrusion Detection using Resampling Techniques

“…In order to perform better with minimal features, four different subsets of attribute sets are tested against some well-known classifiers like J48, OneR, RF, Naïve Bayes, Bagging, Simple Logistic, and Multi-Layer Perceptron on AWID dataset [57]. For a meaningful feature selection, an intelligent system was proposed in a study [58] by combining Simulated Annealing (SA) and SVM. It In [50], the authors combined Artificial Neural Network and a Bayesian net in order to form an ensemble classifier.…”