Network intrusion detection system using L1-norm PCA

Abstract

The rapid evolution of information and communication technologies leads to a big networks security problem. For this reason, the Intrusion Detection System (IDS) has been developed in order to detect and prevent computer network attacks. However, the majority of IDSs operate on huge network traffic data with many useless and redundant features. Consequently, the IDS generates a lot of false alarms and the intrusion detection process becomes difficult and imprecise. To improve the performance of an IDS, many data dimensionality reduction methods, such as Principal Component Analysis (PCA), have been proposed. However, the classical PCA approach, that is based on the covariance matrix of the data, is very sensitive to outliers. In order to overcome this problem, we propose to introduce a new variant of PCA namely L1-norm PCA. This new method is based on the L1-norm maximization, which is more robust to outliers, instead of the Euclidean norm in the classical PCA. Extensive experiments on the well-known KDDcup99 dataset are exploited for testing the effectiveness of the proposed approach. Obtained results confirm the superiority of L1-norm PCA over the traditional PCA in terms of network attacks detection and false alarms reduction.

Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges

“…Khalid et al [254] PCA Applied L1 norm PCA for dimensionality reduction in network intrusion detection system.…”

An anomaly-based intrusion detection system in presence of benign outliers with visualization capabilities

“…To overcome the anomaly-based IDS weaknesses, various artificial and computational intelligence algorithms either integrating with meta-heuristic optimization approaches or without them are investigated, such as fuzzy logic Karami & Guerrero-Zapata (2015b); Feizollah et al (2013), Support Vector Machine (SVM) Kabir et al (2017); Bao & Wang (2016), Radial Basis Function (RBF) Karami & Guerrero-Zapata (2015c); Bi et al (2009), Artificial Neural Network (ANN) Subba et al (2016); Hodo et al (2016), Self-Organizing Map (SOM) la Hoz et al 2015; Karami & Guerrero-Zapata (2014); dong Wang et al (2007), Adaptive Neuro-Fuzzy Inference System (ANFIS) Devi et al (2017); Karami & Guerrero-Zapata (2015a), and Principle Component Analysis (PCA) An & Weber (2017); Khalid et al (2015). Nevertheless, the major drawbacks of anomaly-based IDSs exist in terms of the lower detection precision and the higher false positive rate in presence of low-frequent patterns called outliers, resulting in weaker detection stability Karami & Guerrero-Zapata (2015b); Jabez & Muthukumar (2015); Luo & Xia (2014).…”