HC-DTTSVM: A Network Intrusion Detection Method Based on Decision Tree Twin Support Vector Machine and Hierarchical Clustering

Abstract

Network intrusion detection is an important technology in national cyberspace security strategy and has become a research hotspot in various cyberspace security issues in recent years. The development of effective and efficient intelligent network intrusion detection methods using advanced machine learning algorithms is of great importance for defending against various network intrusions in complex network environments. In this study, a network intrusion detection method based on decision tree twin support vector machine and hierarchical clustering, named HC-DTTWSVM, is proposed, which can effectively detect different categories of network intrusion. First, the hierarchical clustering algorithm is applied to construct the decision tree for network traffic data, where the bottom-up merging approach is used to maximize the separation of the upper nodes of the decision tree, which reduces the error accumulation in the construction of the decision tree. Then, twin support vector machines are embedded in the constructed decision tree to implement the network intrusion detection model, which can effectively detect the network intrusion category in a top-down manner. The detection performance of the proposed HC-DTTWSVM method is evaluated on NSL-KDD and UNSW-NB15 intrusion detection benchmark datasets. Experimental results show that HC-DTTWSVM can effectively detect different categories of network intrusion and achieves comparable detection performance compared to some of the recently proposed network intrusion detection methods.INDEX TERMS Network intrusion detection, twin support vector machine, hierarchical clustering, decision tree.

RETRACTED ARTICLE: Fusion of transformer and ML-CNN-BiLSTM for network intrusion detection

“…The core theoretical goal of deep learning networks is to learn models from data, so that the learned models can be well applied to new samples, with strong generalization ability [18,19]. Wen et al [20] uses convolutional neural network models to construct NIDS models, reduce node data redundancy, and extract abnormal behavior sample features.…”

“…10, when the dropout is 0.09, the model cannot fully learn the data features due to too many discarded network elements during training, resulting in a poor effect in reducing the loss value. When the dropout is 0.01 or 0.05, there are varying degrees of (19)…”

Application of GA-WELM Model Based on Stratified Cross-Validation in Intrusion Detection

“…Select four existing models [39][40][41][42] as comparison models. In the test, a p < 0.05 was considered to indicate statistical significance.…”

Fusion of Transformer and ML-CNN-BiLSTM for Network Intrusion Detection

“…The core theoretical goal of deep learning networks is to learn models from data, so that the learned models can be well applied to new samples, with strong generalization ability [18][19]. Reference [20] uses convolutional neural network models to construct NIDS models, reduce node data redundancy, and extract abnormal behavior sample features; Reference [21] first identifies a single attack based on generating adversarial networks, and integrates multiple network models to achieve multiple types of comprehensive network monitoring; Reference [22] combines unsupervised and supervised analysis of network traffic within channels, and introduces a triple convolutional neural network (TCNN) for feature extraction; Reference [23] proposed combined the multi-classifier and recursive neural networks (MCRNN) to generate corresponding network monitoring models to achieve efficient identification and processing of network attacks.…”