Hybrid Intrusion Detection: Combining Decision Tree and Gaussian Mixture Model

Bitaab, Marzieh; Hashemi, Sattar

doi:10.1109/iscisc.2017.8488375

Cited by 18 publications

(7 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Lekha et al [8] propose a method to create rules and classify known attacks using CART, it uses an Extreme Learning Machine (ELM) for the classification of normal and abnormal activities. Bitaab et al [9] propose a method to do misuse detection based on DT and anomaly detection based on a Gaussian Mixture Model for classification of normal and unknown attacks. Al-Yaseen et al [10] propose an intrusion detection system based on SVM and ELM.…”

Section: Hybrid Intrusion Detectionmentioning

confidence: 99%

“…A hybrid intrusion detection system is designed to overcome the problem of excessive false alarms about attacks in anomaly detection and the disadvantage of detecting only known attacks in misuse detection. Also, ML and DM are applied for the detection of unknown attacks [3,[5][6][7][8][9][10]. However, these methods are also difficult to detect hidden attacks such as attacks like normal or unknown attacks similar to known attacks.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Unknown Attack Detection: Combining Relabeling and Hybrid Intrusion Detection

Shin¹,

Kim²,

Kim³

et al. 2021

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Detection of unknown attacks like a zero-day attack is a research field that has long been studied. Recently, advances in Machine Learning (ML) and Artificial Intelligence (AI) have led to the emergence of many kinds of attack-generation tools developed using these technologies to evade detection skillfully. Anomaly detection and misuse detection are the most commonly used techniques for detecting intrusion by unknown attacks. Although anomaly detection is adequate for detecting unknown attacks, its disadvantage is the possibility of high false alarms. Misuse detection has low false alarms; its limitation is that it can detect only known attacks. To overcome such limitations, many researchers have proposed a hybrid intrusion detection that integrates these two detection techniques. This method can overcome the limitations of conventional methods and works better in detecting unknown attacks. However, this method does not accurately classify attacks like similar to normal or known attacks. Therefore, we proposed a hybrid intrusion detection to detect unknown attacks similar to normal and known attacks. In anomaly detection, the model was designed to perform normal detection using Fuzzy c-means (FCM) and identify attacks hidden in normal predicted data using relabeling. In misuse detection, the model was designed to detect previously known attacks using Classification and Regression Trees (CART) and apply Isolation Forest (iForest) to classify unknown attacks hidden in known attacks. As an experiment result, the application of relabeling improved attack detection accuracy in anomaly detection by approximately 11% and enhanced the performance of unknown attack detection in misuse detection by approximately 10%.

show abstract

Section: Hybrid Intrusion Detectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Unknown Attack Detection: Combining Relabeling and Hybrid Intrusion Detection

Shin¹,

Kim²,

Kim³

et al. 2021

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…This means that an IDS leveraging only Decision Trees cannot identify patterns in packets exchanged by the hosts, which prevents the IDS to detect a wide variety of potentially malicious messages. For this reason Decision Trees are not well suited for identify zero-day attacks and performing anomaly detection, although some literature leveraged Decision Trees enhanced with other ML technique [98], [99], [100]. Malik et al [101] proposed an Intrusion Detection System based on Decision Trees with a technique based on Particle Swarm Optimization (PSO) to prune the tree.…”

Section: Decision Treementioning

confidence: 99%

Intrusion Detection Systems for IoT: opportunities and challenges offered by Edge Computing and Machine Learning

Spadaccino¹,

Cuomo²

2020

Preprint

View full text Add to dashboard Cite

Key components of current cybersecurity methods are the Intrusion Detection Systems (IDSs) were different techniques and architectures are applied to detect intrusions. IDSs can be based either on cross-checking monitored events with a database of known intrusion experiences, known as signature-based, or on learning the normal behavior of the system and reporting whether some anomalous events occur, named anomaly-based. This work is dedicated to the application to the Internet of Things (IoT) network where edge computing is used to support the IDS implementation. New challenges that arise when deploying an IDS in an edge scenario are identified and remedies are proposed. We focus on anomaly-based IDSs, showing the main techniques that can be leveraged to detect anomalies and we present machine learning techniques and their application in the context of an IDS, describing the expected advantages and disadvantages that a specific technique could cause.

show abstract

“…The KDD99 and NSL-KDD datasets have also been used to test a variety of non neural-based techniques such as Support Vector Machine [29]- [33], Principal Component Analysis [34]- [38], Decision Trees [39]- [42], [42], [43], and various unsupervised approaches [44]- [49].…”

Section: Related Work On ML Techniques Applied To Network Intrusion D...mentioning

confidence: 99%

Experimental Review of Neural-based approaches for Network Intrusion Management

Di Mauro,

Galatro,

Liotta

2020

Preprint

View full text Add to dashboard Cite

Hybrid Intrusion Detection: Combining Decision Tree and Gaussian Mixture Model

Cited by 18 publications

References 13 publications

Unknown Attack Detection: Combining Relabeling and Hybrid Intrusion Detection

Unknown Attack Detection: Combining Relabeling and Hybrid Intrusion Detection

Intrusion Detection Systems for IoT: opportunities and challenges offered by Edge Computing and Machine Learning

Experimental Review of Neural-based approaches for Network Intrusion Management

Contact Info

Product

Resources

About