Genetic Algorithm to Improve SVM Based Network Intrusion Detection System

Published 25 April 2005

Dong Seong Kim, Ha-Nam Nguyen, Jong Sou Park

DOI10.1109/aina.2005.191

Citations122

TL;DR

Through fusions of GA and SVM, the "optimal detection model" for SVM classifier can be determined and this fusion enhances the overall performance of SVM based IDS.

Abstract

In this paper, we propose genetic algorithm (GA) to improve support vector machines (SVM) based intrusion detection system (IDS). SVM is relatively a novel classification technique and has shown higher performance than traditional learning methods in many applications. So several security researchers have proposed SVM based IDS. We use fusions of GA and SVM to enhance the overall performance of SVM based IDS. Through fusions of GA and SVM, the "optimal detection model" for SVM classifier can be determined. As the result of this fusion, SVM based IDS not only select "optimal parameters "for SVM but also "optimal feature set" among the whole feature set. We demonstrate the feasibility of our method by performing several experiments on KDD 1999 intrusion detection system competition dataset.

Keywords

Computer ScienceEngineering

The Nature of Statistical Learning Theory

39,279 Citations1995Vladimir Vapnik

The MIT Press eBooksAn Introduction to Genetic Algorithms

11,203 Citations1996Melanie Mitchell

An Introduction to Genetic Algorithms focuses in depth on a small set of important and interesting topics -- particularly in machine learning, scientific modeling, and artificial life -- and reviews a broad span of research, including the work of Mitchell and her colleagues.

Intrusion detection using neural networks and support vector machines

811 Citations2003Srinivas Mukkamala, G. Janoski +1 more

Using a set of benchmark data from a KDD (knowledge discovery and data mining) competition designed by DARPA, it is demonstrated that efficient and accurate classifiers can be built to detect intrusions.

Feature selection for support vector machines by means of genetic algorithm

338 Citations2004Holger Fröhlich, Olivier Chapelle +1 more

This paper presents a special genetic algorithm, which especially takes into account the existing bounds on the generalization error for support vector machines (SVMs), which is compared to the traditional method of performing cross-validation and to other existing algorithms for feature selection.

Stateful intrusion detection for high-speed network's

237 Citations2005Christopher Kruegel, F. Valeur +2 more

A partitioning approach to network security, analysis that supports in-depth, stateful intrusion detection on high-speed links that is centered around a slicing mechanism that divides the overall network traffic into subsets of manageable size.

International Conference on Machine Learning and ApplicationsRobust Support Vector Machines for Anomaly Detection in Computer Security.

184 Citations2003Wenjie Hu, Yi‐Hua Liao +1 more

Using the 1998 DARPA BSM data set collected at MIT’s Lincoln Labs to study intrusion detection systems, the performance of robust support vector machines (RVSMs) was compared with that of conventionalSupport vector machines and nearest neighbor classifiers in separating normal usage profiles from intrusive profiles of computer programs.

Lecture notes in computer scienceNetwork-Based Intrusion Detection with Support Vector Machines

130 Citations2003Dong Seong Kim, Jong Sou Park

The results of experiments demonstrate that applying SVM in Intrusion Detection System can be an effective and efficient way for detecting intrusions.

Gene selection for cancer classification using bootstrapped genetic algorithms and support vector machines

55 Citations2004Xiaobin Chen

This paper proposes a novel system for selecting a set of genes for cancer classification based on a linear support vector machine and a genetic algorithm that is capable of finding genes that discriminate between normal cells and cancer cells and generalizes well.

Lecture notes in computer scienceAnomaly Detection Enhanced Classification in Computer Intrusion Detection

33 Citations2002Mike Fugate, James Gattiker

This paper describes experiences and results applying Support Vector Machine (SVM) to a Computer Intrusion Detection (CID) dataset, emphasizing incorporation of anomaly detection in the modeling and prediction of cyber-attacks.

View PDF

Lecture notes in computer scienceDetermining Optimal Decision Model for Support Vector Machine by Genetic Algorithm

19 Citations2004Syng-Yup Ohn, Ha-Nam Nguyen +2 more

A new method to find the optimal decision model for SVM, which consists of the minimal set of highly discriminative features and the set of parameters for the kernel, is proposed.