Cyber Attack Detection System based on Improved Support Vector Machine

Abstract

This paper presents a novel cyber attack classification approach using improved Support Vector Machine (iSVM) by modifying Gaussian kernel. The Support Vector Machine (SVM) is based on machine learning technique known to perform well at various pattern recognition tasks; such as image classification, text categorization and handwritten character recognition. The cyber attack detection is basically a pattern classification problem, in which classification of normal pattern is done from the abnormal pattern (attack). Although, traditional SVM is better classifier in terms of fast training, scalable and generalization capability. Performance of traditional SVM is enhanced in this work by modifying Gaussian kernel to enlarge the spatial resolution around the margin by a conformal mapping, so that the separability between attack classes is increased. It is based on the Riemannian geometrical structure induced by the kernel function. In the proposed method, class specific Cyber Attack Detection System which combines feature reduction technique and improved support vector machine classifier. This technique has two phases, in the first phase we reduced the redundant features of the original KDDCUP2009 dataset by Generalized Discriminant Analysis (GDA). In the second phase we used improved Support Vector Machine (iSVM) classifier to classify the reduced dataset obtained from first phase. Result shows that iSVM gives 100% detection accuracy for Normal and Denial of Service (DOS) classes and comparable to false alarm rate, training, and testing times.

Machine learning in cybersecurity: a comprehensive survey

“…To reduce the false alarm rate of the previous works, Shailendra Singh 97 designed an improvement of the SVM algorithm by modifying the Gaussian Kernel to enlarge the spatial resolution around the support margin to increase the distance of several classes. Shailendra Singh's 97 approach is divided into two steps. In the first phase, generalized discriminant analysis (GDA) is used to reduce the feature dimension, and in the next phase the improved SVM to detect anomaly is utilized.…”

The Challenges of Leveraging Threat Intelligence to Stop Data Breaches

“…Over the past decade ML techniques have been widely used to enable systematic learning and building of enterprise systems' normal profiles to detect anomalies and zero-day threats (Conti et al, 2018). ML includes a large variety of models in continuous evolution, presenting weak boundaries and cross relationships, and has already been successfully applied within various contexts in cybersecurity (Dua and Du, 2011;Ford and Siraj, 2014;Singh and Silakari, 2015;Buczak and Guven, 2016;Fraley and Cannady, 2017;Ghanem et al, 2017;Yadav et al, 2017;Apruzzese et al, 2018). The book by Dua and Du (2011) provides a comprehensive guide to how ML and data mining are incorporated in cybersecurity tools, and in particular, it provides examples of anomaly detection, misuse detection, profiling detection, etc.…”

“…This study looks at whether current state of the art approaches in ML are effective for identifying malware, spam and intrusions and also allude to the current limitations of these approaches. Studies have also considered support vector machines for dealing with cybersecurity issues (Singh and Silakari, 2015;Ghanem et al, 2017;Yadav et al, 2017). Singh and Silakari (2015) explore support vector machines for cyber attack detection, and in similar fashion, Yadav et al (2017) focus on the problem of classifying cyberattacks.…”

“…Studies have also considered support vector machines for dealing with cybersecurity issues (Singh and Silakari, 2015;Ghanem et al, 2017;Yadav et al, 2017). Singh and Silakari (2015) explore support vector machines for cyber attack detection, and in similar fashion, Yadav et al (2017) focus on the problem of classifying cyberattacks. The study by Ghanem et al (2017) develop an intrusion detection system which is enhanced by support vector machines.…”