A novel intrusion detection system based on hierarchical clustering and support vector machines
Expert Systems with ApplicationsPublished 7 July 2010
Shi‐Jinn Horng, Ming‐Yang Su, Y-H. Chen, Tzong‐Wann Kao, Rong‐Jian Chen, Jui‐Lin Lai
Citations455
SJR quartileQ1
SJR score1.85
SNIP2.55
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This study proposed an SVM-based intrusion detection system, which combines a hierarchical clustering algorithm, a simple feature selection procedure, and the SVM technique, which showed better performance in the detection of DoS and Probe attacks and the beset performance in overall accuracy.
Abstract
This study proposed an SVM-based intrusion detection system, which combines a hierarchical clustering algorithm, a simple feature selection procedure, and the SVM technique. The hierarchical clustering algorithm provided the SVM with fewer, abstracted, and higher-qualified training instances that are derived from the KDD Cup 1999 training set. It was able to greatly shorten the training time, but also improve the performance of resultant SVM. The simple feature selection procedure was applied to eliminate unimportant features from the training set so the obtained SVM model could classify the network traffic data more accurately. The famous KDD Cup 1999 dataset was used to evaluate the proposed system. Compared with other intrusion detection systems that are based on the same dataset, this system showed better performance in the detection of DoS and Probe attacks, and the beset performance in overall accuracy.
Keywords
Computer Science
The Nature of Statistical Learning Theory
39,279 Citations1995Vladimir Vapnik
A Practical Guide to Support Vector Classication
5,069 Citations2008Chih‐Wei Hsu, Chih-Chung Chang +1 more
A simple procedure is proposed, which usually gives reasonable results and is suitable for beginners who are not familiar with SVM.
BIRCH
3,906 Citations1996Tian Zhang, Raghu Ramakrishnan +1 more
A data clustering method named BIRCH (Balanced Iterative Reducing and Clustering using Hierarchies) is presented, and it is demonstrated that it is especially suitable for very large databases.
ComputerChameleon: hierarchical clustering using dynamic modeling
2,102 Citations1999George Karypis, Eui-Hong Han +1 more
Chameleon's key feature is that it accounts for both interconnectivity and closeness in identifying the most similar pair of clusters, which is important for dealing with highly variable clusters.
CURE
1,909 Citations1998Sudipto Guha, Rajeev Rastogi +1 more
This work proposes a new clustering algorithm called CURE that is more robust to outliers, and identifies clusters having non-spherical shapes and wide variances in size, and demonstrates that random sampling and partitioning enable CURE to not only outperform existing algorithms but also to scale well for large databases without sacrificing clustering quality.
Information SystemsRock: A robust clustering algorithm for categorical attributes
1,482 Citations2000Sudipto Guha, Rajeev Rastogi +1 more
ROCK: a robust clustering algorithm for categorical attributes
601 Citations1999Suvajyoti Guha, R. Rastogi +1 more
This work develops a robust hierarchical clustering algorithm, ROCK, that employs links and not distances when merging clusters, and shows that ROCK not only generates better quality clusters than traditional algorithms, but also exhibits good scalability properties.
The VLDB JournalA new intrusion detection system using support vector machines and hierarchical clustering
395 Citations2006Latifur Khan, Mamoun Awad +1 more
This paper presents a new approach of combination of SVM and DGSOT, which starts with an initial training set and expands it gradually using the clustering structure produced by the D GSOT algorithm, which has proved to overcome the drawbacks of traditional hierarchical clustering algorithms.
Classifying large data sets using SVMs with hierarchical clusters
274 Citations2003Hwanjo Yu, Jiong Yang +1 more
CB-SVM applies a hierarchical micro-clustering algorithm that scans the entire data set only once to provide an SVM with high quality samples that carry the statistical summaries of the data such that the summaries maximize the benefit of learning the SVM.
Application of Machine Learning Algorithms to KDD Intrusion Detection Dataset within Misuse Detection Context.
246 Citations2003Maheshkumar Sabhnani, Gürsel Serpen
Empirical results obtained through simulation indicate that noticeable performance improvement was achieved for probing, denial of service, and user-to-root in the KDD 1999 Cup intrusion detection dataset.
Computer CommunicationsA new approach to intrusion detection based on an evolutionary soft computing model using neuro-fuzzy classifiers
226 Citations2007Adel N. Toosi, Mohsen Kahani
Several soft computing techniques are incorporated into the classifying system to detect and classify intrusions from normal behaviors based on the attack type in a computer network, including neuro-fuzzy networks, fuzzy inference approach and genetic algorithms.
ACM SIGKDD Explorations NewsletterWinning the KDD99 classification cup
216 Citations2000Bernhard Pfahringer
The standard sampling with replacement methodology of bagging was modified to put a specific focus on the smaller but expensive-if-predicted-wrongly classes.
ACM SIGKDD Explorations NewsletterKDD-99 classifier learning contest LLSoft's results overview
181 Citations2000I. MICHAEL LEVIN
The Kernel Miner's approach and method used for solving the contest task is described and the received results are analyzed and explained.
A stateful intrusion detection system for world-wide web servers
118 Citations2004Giovanni Vigna, William Robertson +2 more
WebSTAT is presented, an intrusion detection system that analyzes Web requests looking for evidence of malicious behavior and provides a sophisticated language to describe multistep attacks in terms of states and transitions to achieve more effective detection of Web-based attacks.
Evolutionary Design of Intrusion Detection Programs
110 Citations2007Ajith Abraham, Crina Groşan +1 more
Empirical results reveal that genetic programming technique could play a major role in develop- ing an Intrusion Detection Program (IDP) which are light weight and accurate when compared to some of the conventional intrusion detection systems based on machine learning paradigms.
IEEE Transactions on Systems Man and Cybernetics Part B (Cybernetics)An Automatically Tuning Intrusion Detection System
82 Citations2007Zhenwei Yu, Jeffrey J. P. Tsai +1 more
2006 International Conference on Hybrid Information TechnologyAnomaly-Based Intrusion Detection using Fuzzy Rough Clustering
65 Citations2006Witcha Chimphlee, Abdul Hanan Abdullah +3 more
International Conference on Hybrid Information TechnologyAnomaly-Based Intrusion Detection using Fuzzy Rough Clustering
58 Citations2006Witcha Chimphlee, Abdul Hanan Abdullah +3 more
FRCM integrates the advantage of fuzzy set theory and rough set theory that the improved algorithm to network intrusion detection and outperforms the existing unsupervised intrusion detection methods.
Anomaly Detection Based Intrusion Detection
50 Citations2006Dima Novikov, Roman V. Yampolskiy +1 more
It is shown that properly trained neural networks are capable of fast recognition and classification of different attacks and it is possible to recognize attacks that the intrusion detection system never faced before on an acceptably high level.
Modeling Intrusion Detection System by Discovering Association Rule in Rough Set Theory Framework
31 Citations2006Xuren Wang, Famei He +1 more