Intrusion Detection: Supervised Machine Learning

Abstract

Due to the expansion of high-speed Internet access, the need for secure and reliable networks has become more critical. The sophistication of network attacks, as well as their severity, has also increased recently. As such, more and more organizations are becoming vulnerable to attack. The aim of this research is to classify network attacks using neural networks (NN), which leads to a higher detection rate and a lower false alarm rate in a shorter time. This paper focuses on two classification types: a single class (normal, or attack), and a multi class (normal, DoS, PRB, R2L, U2R), where the category of attack is also detected by the NN. Extensive analysis is conducted in order to assess the translation of symbolic data, partitioning of the training data and the complexity of the architecture. This paper investigates two engines; the first engine is the back-propagation neural network intrusion detection system (BPNNIDS) and the second engine is the radial basis function neural network intrusion detection system (BPNNIDS).The two engines proposed in this paper are tested against traditional and other machine learning algorithms using a common dataset: the DARPA 98 KDD99 benchmark dataset from International Knowledge Discovery and Data Mining Tools. BPNNIDS shows a superior response compared to the other techniques reported in literature especially in terms of response time, detection rate and false positive rate.

Performance Comparison of Multi-class SVM with Oversampling Methods for Imbalanced Data Classification

“…As presented in Table 3, the KDD Cup 99 dataset contains 22 training attack types. In this paper, mapping of these attack types is performed based on four classes: denial-of-service (DoS), probing, user to root (U2R), and remote to local (R2L) [17]. Specifically speaking, a DoS attack refers to an attack that is performed to prevent the use of service.…”

A Survey on Intrusion-Tolerant System

“…Hardware-based ITS utilizes hardware architectures, which are specially designed to prevent certain classes of attacks to maintain crucial services. Hierarchical adaptive control of quality of service for intrusion tolerance architecture includes the diverse replication [3] and networkbased IDS [1], as shown in Fig. 1.…”

“…With sophisticated attacks, there are many defendable solutions, such as the detection approach using neural networks [1]. Due to the limitations of the detection approach, a new paradigm is needed.…”

“…Traditional protection techniques, such as intrusion detection systems (IDS) [1], intrusion prevention systems, and firewalls [2], sometimes achieve excellent attack detection and prevention by analyzing previous intrusion records. However, because they are based on existing attack signatures, they cannot detect new and unreported intrusions.…”

Cubic Polynomial Smooth Support Vector Machine Used in Intrusion Detection

“…Intrusion detection can be considered as a classification problem, so all kinds of algorithms are used to detect the network system, e.g. Neural Network algorithm [1], Bayesian algorithm [2] and other Machine learning algorithms [3].However, All of the above methods need a lot of or complete audit data set to achieve the desired performance, and the training time is long. How to extract the characteristics of audit data in the case of small samples, and realize the intrusion detection?…”