TSE-IDS: A Two-Stage Classifier Ensemble for Intelligent Anomaly-Based Intrusion Detection System

Abstract

Intrusion detection systems (IDSs) play a pivotal role in computer security by discovering and repealing malicious activities in computer networks. Anomaly-based IDS, in particular, rely on classification models trained using historical data to discover such malicious activities. In this paper, an improved IDS based on hybrid feature selection and two-level classifier ensembles are proposed. A hybrid feature selection technique comprising three methods, i.e., particle swarm optimization, ant colony algorithm, and genetic algorithm, is utilized to reduce the feature size of the training datasets (NSL-KDD and UNSW-NB15 are considered in this paper). Features are selected based on the classification performance of a reduced error pruning tree (REPT) classifier. Then, a two-level classifier ensemble based on two meta learners, i.e., rotation forest and bagging, is proposed. On the NSL-KDD dataset, the proposed classifier shows 85.8% accuracy, 86.8% sensitivity, and 88.0% detection rate, which remarkably outperform other classification techniques recently proposed in the literature. The results regarding the UNSW-NB15 dataset also improve the ones achieved by several state-of-the-art techniques. Finally, to verify the results, a two-step statistical significance test is conducted. This is not usually considered by the IDS research thus far and, therefore, adds value to the experimental results achieved by the proposed classifier.INDEX TERMS Two-stage meta classifier, network anomaly detection, hybrid feature selection, intrusion detection system, statistical significance test.

Building an efficient intrusion detection system based on feature selection and ensemble classifier

“…The comparison results with some of the existing approaches on these two sets are shown in Table 12. The highest detection accuracy is achieved by the proposed approach based on the experimental results on KDDTest+, which outperforms the other recent IDS techniques, including FSSL [9], FSSL-EL [34], and TSE-IDS [82]. Besides having superior detection accuracy, the proposed method also outperforms significantly other approaches in terms of detection rate metric.…”

“…Although the multi-class classification performance of our proposed method has been proven through experiments, to provide more reference for the readers, we still compare the results of our CFS-BA-Ensemble method with other earlier researches in binary classification based on NSL-KDD, AWID, and CIC-IDS2017 datasets, which is shown in Table 13. First of all, it can be seen in Table 13 that our proposed model outperforms other similar ensemble classifiers, such as FS-EL [83], XGBoost-IDS [13], and TSE-IDS [82] when using 10f cross-validation as a validation technique. There are also some deep learning methods for IDS in the current literature such as DEMISe [69], DeepWindow [79], and HELAD [99].…”

“…Zhong et al [99] also proposed a new anomaly detection model called HELAD, which is based on the Damped Incremental Statistics algorithm for feature selection and organic integration of multiple deep learning techniques for classification. In [82], a novel IDS based on hybrid feature selection and two-level classifier ensembles has been proposed, and experimental results show that it produces a significant improvement of the detection rate on the NSL-KDD and UNSW-NB15 datasets.…”

A Hybrid Intrusion Detection Model Combining SAE with Kernel Approximation in Internet of Things

“…In order to further verify the superiority of the proposed model, we compared the proposed model with related models in other literature, including SCDNN [ 42 ], LSTM 4 [ 43 ], GRU 3 [ 43 ], CFBLS [ 43 ], TSE-IDS [ 44 ], ROS-DNN [ 45 ], SMOTE-DNN [ 45 ], and ADASYN-DNN [ 45 ]. To be fair, all the methods were implemented on NSL-KDDTest+ and NSL-KDDTest21.…”

Epigenetic Algorithm-Based Detection Technique for Network Attacks

“…Owing to this fact, they attract the researchers' attention by proposing new approaches aiming to improve the system security robustness against new potential unknown attacks. Actually, three types of methods used in IDS can be distinguished, namely (i) signature-based method [3], (ii) anomaly-based method [4], and (iii) hybrid signature/anomaly-based method to get a complementary intrusion detection. While signaturebased IDS technique matches the presented attack's signature with a database of known attacks [5], the anomaly-based IDS can effectively identify unknown attacks whose signatures do not exist in database, by learning about certain normal behaviors in the network.…”