Intrusion Detection System Based on Modified K-means and Multi-level Support Vector Machines

Al-Yaseen, Wathiq Laftah; Othman, Zulaiha Ali; Nazri, Mohd Zakree Ahmad

doi:10.1007/978-981-287-936-3_25

Cited by 8 publications

(6 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our study provides better accuracy results for all types of attacks compared to [27][28][29]. Al-Yaseen et al [32] used a modified k-means technique and our study provides better detection rates for U2R and probes compared to [32].…”

Section: Discussionmentioning

confidence: 68%

Modified stacking ensemble approach to detect network intrusion

Demir¹,

Dalkılıç²

2018

Turk J Elec Eng & Comp Sci

View full text Add to dashboard Cite

Detecting intrusions in a network traffic has remained an issue for researchers over the years. Advances in the area of machine learning provide opportunities to researchers to detect network intrusion without using a signature database. We studied and analyzed the performance of a stacking technique, which is an ensemble method that is used to combine different classification models to create a better classifier, on the KDD'99 dataset. In this study, the stacking method is improved by modifying the model generation and selection techniques and by using different classifications algorithms as a combiner method. Model generation is performed using subsets of the dataset with randomly selected features and not all of these models are used as input for the combiner. Various metrics are used in model selection and only selected models are used as input for the combiner method. In our experiments, the stacking technique provided higher accuracy results all the time compared to pure machine learning techniques. The second important result in our experiments was obtaining the highest detection rate for user-to-root attacks compared to other studies.

show abstract

Section: Discussionmentioning

confidence: 68%

Modified stacking ensemble approach to detect network intrusion

Demir¹,

Dalkılıç²

2018

Turk J Elec Eng & Comp Sci

View full text Add to dashboard Cite

show abstract

“…Enamul et al use sampling technique to select representative dataset and Least Squares SVM to identify anomalous network data [8], proving that data sampling can improve the accuracy and speed of intrusion detection. Alyaseen et al combine modified K-means with machine learning methods to build intrusion detection models [9][10][11]. The modified K-means method can discover similar structures and models between datasets to compress datasets with higher quality.…”

Section: Related Workmentioning

confidence: 99%

“…The modified K-means method can discover similar structures and models between datasets to compress datasets with higher quality. Integrating K-means with C4.5 to construct the classifier of intrusion detection model can greatly reduce the running time of intrusion detection system [9]; with SVM algorithm it can effectively improve performance for detecting DoS anomaly [10]; and with hybrid model of SVM and extreme learning machine (ELM) it can improve accuracy and efficiency of IDS [11].…”

Section: Related Workmentioning

confidence: 99%

“…Basic Features state(1), dur(2), sbytes(3), dbytes(4), sttl(5), dttl (6), sloss (7), dloss (8), service (9), sload (10), dload (11), spkts (12), dpkts (13) Content Features swin (14), dwin (15), stcpb (16), dtcpb (17), smeansz (18), dmeansz (19), trans depth (20), res bdy len (21) Time Features sjit (22), djit (23), stime (24), ltime (25), sintpkt (26), dintpkt (27), tcprtt (28), synack (29), ackdat (30) Additional Generated Features is sm ips ports(31), ct state ttl(32), ct flw http mthd(33), is ftp login(34), ct ftp cmd(35), ct srv src(36), ct srv dst(37), ct dst ltm(38), ct src ltm(39), ct src dport ltm(40), ct dst sport ltm(41), ct dst src ltm(42) 8,9,10,12,13,17,19,20,22,24,25,26,27,28,29,30,34,35,38 20 Shellcode 3,4,5,…”

Section: Classmentioning

confidence: 99%

See 1 more Smart Citation

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

Ren

Guo

Wang

et al. 2019

Security and Communication Networks

View full text Add to dashboard Cite

Intrusion detection system (IDS) can effectively identify anomaly behaviors in the network; however, it still has low detection rate and high false alarm rate especially for anomalies with fewer records. In this paper, we propose an effective IDS by using hybrid data optimization which consists of two parts: data sampling and feature selection, called DO_IDS. In data sampling, the Isolation Forest (iForest) is used to eliminate outliers, genetic algorithm (GA) to optimize the sampling ratio, and the Random Forest (RF) classifier as the evaluation criteria to obtain the optimal training dataset. In feature selection, GA and RF are used again to obtain the optimal feature subset. Finally, an intrusion detection system based on RF is built using the optimal training dataset obtained by data sampling and the features selected by feature selection. The experiment will be carried out on the UNSW-NB15 dataset. Compared with other algorithms, the model has obvious advantages in detecting rare anomaly behaviors.

show abstract

“…However, because of the randomness of the sampling technique, it is impossible to evaluate the sampling data objectively. Wathiq et al [18][19][20] proposed an improved K-means method to extract each majority category and select partial representative data. Ren et al [21] adopted KNN outlier detection algorithm to select data with locating in the central region.…”

Section: Introductionmentioning

confidence: 99%

A Novel Network Anomaly Detection Method based on Data Balancing and Recursive Feature Addition

2020

KSII TIIS

View full text Add to dashboard Cite

Network anomaly detection system plays an essential role in detecting network anomaly and ensuring network security. Anomaly detection system based machine learning has become an increasingly popular solution. However, due to the unbalance and high-dimension characteristics of network traffic, the existing methods unable to achieve the excellent performance of high accuracy and low false alarm rate. To address this problem, a new network anomaly detection method based on data balancing and recursive feature addition is proposed. Firstly, data balancing algorithm based on improved KNN outlier detection is designed to select part respective data on each category. Combination optimization about parameters of improved KNN outlier detection is implemented by genetic algorithm. Next, recursive feature addition algorithm based on correlation analysis is proposed to select effective features, in which a cross contingency test is utilized to analyze correlation and obtain a features subset with a strong correlation. Then, random forests model is as the classification model to detection anomaly. Finally, the proposed algorithm is evaluated on benchmark datasets KDD Cup 1999 and UNSW_NB15. The result illustrates the proposed strategies enhance accuracy and recall, and decrease the false alarm rate. Compared with other algorithms, this algorithm still achieves significant effects, especially recall in the small category.

show abstract

Intrusion Detection System Based on Modified K-means and Multi-level Support Vector Machines

Cited by 8 publications

References 15 publications

Modified stacking ensemble approach to detect network intrusion

Modified stacking ensemble approach to detect network intrusion

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

A Novel Network Anomaly Detection Method based on Data Balancing and Recursive Feature Addition

Contact Info

Product

Resources

About