Intrusion detection system for wireless mesh network using multiple support vector machine classifiers with genetic-algorithm-based feature selection

Vijayanand, R.; Devaraj, D.; Kannapiran, B.

doi:10.1016/j.cose.2018.04.010

Cited by 147 publications

(60 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In wireless mesh environments, Vijayan et al [10] proposed an intrusion detection system that used the genetic algorithm (GA) as a feature selection method and multiple Support Vector Machines (SVM) for classification. Their system was based on a linear combination of multiple SVM classifiers, which were ordered based on the severity of the attacks.…”

Section: Cicids2017 Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Features Dimensionality Reduction Approaches for Machine Learning Based Network Intrusion Detection

et al. 2019

View full text Add to dashboard Cite

The security of networked systems has become a critical universal issue that influences individuals, enterprises and governments. The rate of attacks against networked systems has increased dramatically, and the tactics used by the attackers are continuing to evolve. Intrusion detection is one of the solutions against these attacks. A common and effective approach for designing Intrusion Detection Systems (IDS) is Machine Learning. The performance of an IDS is significantly improved when the features are more discriminative and representative. This study uses two feature dimensionality reduction approaches: (i) Auto-Encoder (AE): an instance of deep learning, for dimensionality reduction, and (ii) Principle Component Analysis (PCA). The resulting low-dimensional features from both techniques are then used to build various classifiers such as Random Forest (RF), Bayesian Network, Linear Discriminant Analysis (LDA) and Quadratic Discriminant Analysis (QDA) for designing an IDS. The experimental findings with low-dimensional features in binary and multi-class classification show better performance in terms of Detection Rate (DR), F-Measure, False Alarm Rate (FAR), and Accuracy. This research effort is able to reduce the CICIDS2017 dataset’s feature dimensions from 81 to 10, while maintaining a high accuracy of 99.6% in multi-class and binary classification. Furthermore, in this paper, we propose a Multi-Class Combined performance metric C o m b i n e d M c with respect to class distribution to compare various multi-class and binary classification systems through incorporating FAR, DR, Accuracy, and class distribution parameters. In addition, we developed a uniform distribution based balancing approach to handle the imbalanced distribution of the minority class instances in the CICIDS2017 network intrusion dataset.

show abstract

Section: Cicids2017 Related Workmentioning

confidence: 99%

“…Sort the Eigen-vectors by decreasing the Eigen-values and choose k Eigen-vectors with the largest Eigen-values to form W. 8. Use W to transform the samples onto the new subspace using Equation (10).…”

Section: Dimensionality Reduction Using Aementioning

confidence: 99%

Features Dimensionality Reduction Approaches for Machine Learning Based Network Intrusion Detection

et al. 2019

View full text Add to dashboard Cite

show abstract

“…Though the training of deep learning depends on the huge amount of training data heavily, and the hyper-parameters optimization of deep neural networks is difficult [18]. In the above methods, the support vector machine (SVM) algorithm is a kind of supervised learning algorithm based on statistical theory [19]. And based on the kernel function transformation and structural risk minimization (SRM) principle, the traffic classification is transformed into a quadratic optimization problem, which has good classification accuracy and stability.…”

Section: Methods Based On Machine Learning Techniquesmentioning

confidence: 99%

An Improved Network Traffic Classification Model Based on a Support Vector Machine

Cao

et al. 2020

Symmetry

View full text Add to dashboard Cite

Network traffic classification based on machine learning is an important branch of pattern recognition in computer science. It is a key technology for dynamic intelligent network management and enhanced network controllability. However, the traffic classification methods still facing severe challenges: The optimal set of features is difficult to determine. The classification method is highly dependent on the effective characteristic combination. Meanwhile, it is also important to balance the experience risk and generalization ability of the classifier. In this paper, an improved network traffic classification model based on a support vector machine is proposed. First, a filter-wrapper hybrid feature selection method is proposed to solve the false deletion of combined features caused by a traditional feature selection method. Second, to balance the empirical risk and generalization ability of support vector machine (SVM) traffic classification model, an improved parameter optimization algorithm is proposed. The algorithm can dynamically adjust the quadratic search area, reduce the density of quadratic mesh generation, improve the search efficiency of the algorithm, and prevent the over-fitting while optimizing the parameters. The experiments show that the improved traffic classification model achieves higher classification accuracy, lower dimension and shorter elapsed time and performs significantly better than traditional SVM and the other three typical supervised ML algorithms.

show abstract

“…Faris H et al propose an intelligent detection system that is based on GA and Random Weight Network to deal with email spam detection tasks [22], and the experimental results confirm that the proposed system can achieve remarkable results in terms of accuracy, precision, and recall. Vijayanand R et al propose a novel intrusion detection system with GA based feature selection and multiple support vector machine classifiers for wireless mesh networks [23]. The system proposed by them exhibits a high accuracy of attack detection and is suitable for intrusion detection in wireless mesh networks.…”

Section: Related Workmentioning

confidence: 99%

“…Basic Features state(1), dur(2), sbytes(3), dbytes(4), sttl(5), dttl (6), sloss (7), dloss (8), service (9), sload (10), dload (11), spkts (12), dpkts (13) Content Features swin (14), dwin (15), stcpb (16), dtcpb (17), smeansz (18), dmeansz (19), trans depth (20), res bdy len (21) Time Features sjit (22), djit (23), stime (24), ltime (25), sintpkt (26), dintpkt (27), tcprtt (28), synack (29), ackdat (30) Additional Generated Features is sm ips ports(31), ct state ttl(32), ct flw http mthd(33), is ftp login(34), ct ftp cmd(35), ct srv src(36), ct srv dst(37), ct dst ltm(38), ct src ltm(39), ct src dport ltm(40), ct dst sport ltm(41), ct dst src ltm(42) 8,9,10,12,13,17,19,20,22,24,25,26,27,28,29,30,34,35,38 20 Shellcode 3,4,5,…”

Section: Classmentioning

confidence: 99%

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

Ren

Guo

Wang

et al. 2019

Security and Communication Networks

View full text Add to dashboard Cite

Intrusion detection system (IDS) can effectively identify anomaly behaviors in the network; however, it still has low detection rate and high false alarm rate especially for anomalies with fewer records. In this paper, we propose an effective IDS by using hybrid data optimization which consists of two parts: data sampling and feature selection, called DO_IDS. In data sampling, the Isolation Forest (iForest) is used to eliminate outliers, genetic algorithm (GA) to optimize the sampling ratio, and the Random Forest (RF) classifier as the evaluation criteria to obtain the optimal training dataset. In feature selection, GA and RF are used again to obtain the optimal feature subset. Finally, an intrusion detection system based on RF is built using the optimal training dataset obtained by data sampling and the features selected by feature selection. The experiment will be carried out on the UNSW-NB15 dataset. Compared with other algorithms, the model has obvious advantages in detecting rare anomaly behaviors.

show abstract

Intrusion detection system for wireless mesh network using multiple support vector machine classifiers with genetic-algorithm-based feature selection

Cited by 147 publications

References 22 publications

Features Dimensionality Reduction Approaches for Machine Learning Based Network Intrusion Detection

Features Dimensionality Reduction Approaches for Machine Learning Based Network Intrusion Detection

An Improved Network Traffic Classification Model Based on a Support Vector Machine

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

Contact Info

Product

Resources

About