Design of mnitiple-level tree classifiers for intrusion detection system

Chen, Xiang; Chong, M.Y.; Zhu, Hongxu

doi:10.1109/iccis.2004.1460703

Cited by 15 publications

(6 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This IDS is composed of 4 stages of classification like the three-level tree classifier. 32 The experiments on KDD'99 show that HPCANN gives a good performance for the low frequent attacks, but on the other hand, it affects the performance of the correct classification of normal behavior and frequent attacks like Denial of Service (DoS) attacks.…”

Section: Related Workmentioning

confidence: 99%

An intrusion detection system based on combining probability predictions of a tree of classifiers

Ahmim

Derdour

Ferrag

2018

Int J Communication

View full text Add to dashboard Cite

Intrusion detection system (IDS) represents an unavoidable tool to secure our network. It is considered as a second defense line against the different form of attacks. The principal limits of the current IDSs are their inability to combine the detection of the new form of attacks with high detection rate and low false alarm rate. In this paper, we propose an intrusion detection system based on the combination of the probability predictions of a tree of classifiers. Specifically, our model is composed of 2 layers. The first one is a tree of classifiers. The second layer is a classifier that combines the probability predictions of the tree.The built tree contains 4 levels where each node of this tree represents a classifier. The first node classifies the connections in 2 clusters: Denial of Service attacks and Cluster 2. Then, the second node classifies the connections of the Cluster 2 in Probing attacks and Cluster 3. The third node classifies the connections of the Cluster 3 in Remote-to-Local attacks and Cluster 4. Finally, the last node classifies the connections of the Cluster 4 in User-to-Root attacks and Normal connections. The second layer contains the last classifier that combines the probability predictions of the first layer and take the final decision. The experiments on KDD'99 and NSL-KDD show that our model gives a low false alarm rate and the highest detection rate. Furthermore, our model is more precise than the recent intrusion detection system models with accuracy equal to 96.27% for KDD'99 and 89.75% for NSL-KDD. KEYWORDScomputer security, data mining, hybrid IDS, hierarchical IDS, intrusion detection system, IDS, network security Int J Commun Syst. 2018;31:e3547.wileyonlinelibrary.com/journal/dac

show abstract

Section: Related Workmentioning

confidence: 99%

An intrusion detection system based on combining probability predictions of a tree of classifiers

Ahmim

Derdour

Ferrag

2018

Int J Communication

View full text Add to dashboard Cite

show abstract

“…ICS 23,1 Xiang et al (2008) have proposed multiple-level hybrid IDS-based supervised tree classifiers and unsupervised Bayesian clustering. This model has four stages of classification similar to the well-known three-level tree classifier (Xiang et al, 2004). Tong et al (2009) have proposed hybrid IDS-based RBF/Elman neural networks.…”

Section: Related Workmentioning

confidence: 99%

A new hierarchical intrusion detection system based on a binary tree of classifiers

Ahmim

Zine

2015

Information &Amp; Computer Security

View full text Add to dashboard Cite

A new hierarchical intrusion detection system based on a binary tree of classifiers Ahmed Ahmim Nacira Ghoualmi Zine Article information:To cite this document: Ahmed Ahmim Nacira Ghoualmi Zine , (2015),"A new hierarchical intrusion detection system based on a binary tree If you would like to write for this, or any other Emerald publication, then please use our Emerald for Authors service information about how to choose which publication to write for and submission guidelines are available for all. Please visit www.emeraldinsight.com/authors for more information. About Emerald www.emeraldinsight.comEmerald is a global publisher linking research and practice to the benefit of society. The company manages a portfolio of more than 290 journals and over 2,350 books and book series volumes, as well as providing an extensive range of online products and additional customer resources and services.Emerald is both COUNTER 4 and TRANSFER compliant. The organization is a partner of the Committee on Publication Ethics (COPE) and also works with Portico and the LOCKSS initiative for digital archive preservation. AbstractPurpose -The purpose of this paper is to build a new hierarchical intrusion detection system (IDS) based on a binary tree of different types of classifiers. The proposed IDS model must possess the following characteristics: combine a high detection rate and a low false alarm rate, and classify any connection in a specific category of network connection. Design/methodology/approach -To build the binary tree, the authors cluster the different categories of network connections hierarchically based on the proportion of false-positives and false-negatives generated between each of the two categories. The built model is a binary tree with multi-levels. At first, the authors use the best classifier in the classification of the network connections in category A and category G2 that clusters the rest of the categories. Then, in the second level, they use the best classifier in the classification of G2 network connections in category B and category G3 that represents the different categories clustered in G2 without category B. This process is repeated until the last two categories of network connections. Note that one of these categories represents the normal connection, and the rest represent the different types of abnormal connections. Findings -The experimentation on the labeled data set for flow-based intrusion detection, NSL-KDD and KDD'99 shows the high performance of the authors' model compared to the results obtained by some well-known classifiers and recent IDS models. The experiments' results show that the authors' model gives a low false alarm rate and the highest detection rate. Moreover, the model is more accurate than some well-known classifiers like SVM, C4.5 decision tree, MLP neural network and naïve Bayes with accuracy equal to 83.26 per cent on NSL-KDD and equal to 99.92 per cent on the labeled data set for flow-based intrusion detection. As well, it is more accurate than the best of related works and ...

show abstract

“…Aydyn et al [28] introduce a hybrid IDS combining anomaly-based IDS and misuse-based IDS. To further increase the intrusion detection rate, as well as to simplify the algorithm, a multi-level tree classifier is proposed in [29].…”

Section: Related Workmentioning

confidence: 99%

MLH-IDS: A Multi-Level Hybrid Intrusion Detection Method

Gogoi

Bhattacharyya

Borah

et al. 2013

The Computer Journal

View full text Add to dashboard Cite

With the growth of networked computers and associated applications, intrusion detection has become essential to keeping networks secure. A number of intrusion detection methods have been developed for protecting computers and networks using conventional statistical methods as well as data mining methods. Data mining methods for misuse and anomaly-based intrusion detection, usually encompass supervised, unsupervised and outlier methods. It is necessary that the capabilities of intrusion detection methods be updated with the creation of new attacks. This paper proposes a multi-level hybrid intrusion detection method that uses a combination of supervised, unsupervised and outlierbased methods for improving the efficiency of detection of new and old attacks. The method is evaluated with a captured real-time flow and packet dataset called the Tezpur University intrusion detection system (TUIDS) dataset, a distributed denial of service dataset, and the benchmark intrusion dataset called the knowledge discovery and data mining Cup 1999 dataset and the new version of KDD (NSL-KDD) dataset. Experimental results are compared with existing multi-level intrusion detection methods and other classifiers. The performance of our method is very good.

show abstract

Design of mnitiple-level tree classifiers for intrusion detection system

Cited by 15 publications

References 3 publications

An intrusion detection system based on combining probability predictions of a tree of classifiers

An intrusion detection system based on combining probability predictions of a tree of classifiers

A new hierarchical intrusion detection system based on a binary tree of classifiers

MLH-IDS: A Multi-Level Hybrid Intrusion Detection Method

Contact Info

Product

Resources

About