Intrusion Detection by Ellipsoid Boundary

Abstract

This paper presents a novel approach to describe the normal behavior of computer networks (as used in IDS) based on Support Vector Data Description (SVDD). In the proposed method we find a minimal hyper-ellipse around the normal objects in the input space. Hyper-ellipse can be expanded in high dimensional space (ESVDD) or to be used as a preprocessing in SVDD method (PESVDD) to obtain better results for IDS. KDD-cup99 has been used as data set for test of the proposed method. The overall experiments show prominence of our work in comparison with similar previous works.

Four Decades of Data Mining in Network and Systems Management

“…11) Minimum probability: Like minimum support, this is a probability threshold for mutually dependent items to be considered interesting, for instance, in verifying custom-defined m-patterns in an approach to isolating failures based of items infrequency. 12) Slack variable, ξ: In an intrusion detection approach based on ellipsoid [98], a slack variable was introduced to penalize large distances from hyper-ellipses. 13) Similarity: When jobs are similar but have occurred in different nodes at the same time, they are considered to be spatially correlated [70].…”

Anomaly Intrusion Detection Based on Hyper-ellipsoid in the Kernel Feature Space

“…This model may be subject to misclassification for newly emerging attacks by creating a decision boundary including the unobserved area [2] . To overcome this problem, one-class SVM (e.g., SVDD) and its variations have been implemented in AID [7][8][9][10][11] . It is possible to find the decision boundary of the normal class for AID because the training result is not affected by data instances from the abnormal class and does not include the unobserved area.…”

“…With anomaly detection, one class of data is regarded as the target class, and the remaining data is classified as an outlier (or anomalous data). Because the other class of data might be available only with difficulty, and because only the normal class of data is easy to obtain in general, one-class classification methods are recently adopted for anomaly detection [6][7][8][9][10][11] . One of the best-known support vector learning methods for anomaly detection (i.e., one-class SVM) is the support vector data description (SVDD) [12] .…”

“…Because the hyper-sphere in the input space can express only a limited region of the target class, the SVDD enhances its expressing capability by using balls defined in the kernel feature space with kernel tricks. However, even with balls in the feature space, the expressing capability of the SVDD can be limited [10,11,[13][14][15][16] . To address the difficulty with standard SVDD, modified SVDDs that find the ellipsoidal decision boundary for normal data are proposed.…”

“…To address the difficulty with standard SVDD, modified SVDDs that find the ellipsoidal decision boundary for normal data are proposed. GhasemiGol et al [14] proposed a modified SVDD, viz., the Ellipse SVDD (ESVDD), and implemented it with AID applications [10][11] . The ESVDD finds the tighter decision boundary of a target class by using the hyper-ellipse around the target class defined in the input space.…”