An efficient intrusion detection system based on support vector machines and gradually feature removal method
Expert Systems with ApplicationsPublished 25 July 2011
Yinhui Li, Jingbo Xia, Silan Zhang, Jiakai Yan, Xiaochuan Ai, Kuobin Dai
Citations388
SJR quartileQ1
SJR score1.85
SNIP2.55
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
With the combination of clustering method, ant colony algorithm and support vector machine, an efficient and reliable classifier is developed to judge a network visit to be normal or not.
Abstract
The efficiency of the intrusion detection is mainly depended on the dimension of data features. By using the gradually feature removal method, 19 critical features are chosen to represent for the various network visit. With the combination of clustering method, ant colony algorithm and support vector machine (SVM), an efficient and reliable classifier is developed to judge a network visit to be normal or not. Moreover, the accuracy achieves 98.6249% in 10-fold cross validation and the average Matthews correlation coefficient (MCC) achieves 0.861161.
Keywords
Computer Science
TechnometricsStatistical Learning Theory
26,913 Citations1999Yuhai Wu, Vladimir Vapnik
Presenting a method for determining the necessary and sufficient conditions for consistency of learning process, the author covers function estimates from small data pools, applying these estimations to real-life problems, and much more.
Artificial IntelligenceWrappers for feature subset selection
8,925 Citations1997Ron Kohavi, George H. John
The wrapper method searches for an optimal feature subset tailored to a particular algorithm and a domain and compares the wrapper approach to induction without feature subset selection and to Relief, a filter approach tofeature subset selection.
Expert Systems with ApplicationsIntrusion detection by machine learning: A review
961 Citations2009Chih‐Fong Tsai, Yu‐Feng Hsu +2 more
This chapter reviews 55 related studies in the period between 2000 and 2007 focusing on developing single, hybrid, and ensemble classifiers and discusses current achievements and limitations in developing intrusion detection systems by machine learning.
Systems Research and Behavioral ScienceA clustering technique for summarizing multivariate data
908 Citations1967Geoffrey H. Ball, D.J. Hall
A practical computing method termed ISODATA, which finds the cluster structure of such data, is described and provides a fit to the data of a set of cluster centers that tends to minimize the sum of the squared distances of each data point from its closest cluster center.
Applied Soft ComputingThe use of computational intelligence in intrusion detection systems: A review
694 Citations2009Shelly Xiaonan Wu, Wolfgang Banzhaf
An overview of the research progress in applying CI methods to the problem of intrusion detection is provided, including core methods of CI, including artificial neural networks, fuzzy systems, evolutionary computation, artificial immune systems, swarm intelligence, and soft computing.
Computers & SecurityFeature deduction and ensemble design of intrusion detection systems
602 Citations2004Srilatha Chebrolu, Ajith Abraham +1 more
This study investigated the performance of two feature selection algorithms involving Bayesian networks and Classification and Regression Trees and an ensemble of BN and CART and proposed an hybrid architecture for combining different feature selection algorithm for real world intrusion detection.
Neural ComputationTraining <i>v</i>-Support Vector Classifiers: Theory and Algorithms
503 Citations2001Chih-Chung Chang, Chih‐Jen Lin
Expert Systems with ApplicationsAn intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks
501 Citations2005Ozgur Depren, Murat Topallar +2 more
The principle interest of this work is to benchmark the performance of the proposed hybrid IDS architecture by using KDD Cup 99 Data Set, the benchmark dataset used by IDS researchers.
Expert Systems with ApplicationsA new approach to intrusion detection using Artificial Neural Networks and fuzzy clustering
498 Citations2010Gang Wang, Jin‐Xing Hao +2 more
Experimental results on the KDD CUP 1999 dataset show that the proposed new approach, FC-ANN, outperforms BPNN and other well-known methods such as decision tree, the naive Bayes in terms of detection precision and detection stability.
Naive Bayes vs decision trees in intrusion detection systems
472 Citations2004Nahla Ben Amor, Salem Benferhat +1 more
It is shown that even if having a simple structure, naive Bayes provide very competitive results, and the good performance of Bayes nets with respect to existing best results performed on KDD'99.
The VLDB JournalA new intrusion detection system using support vector machines and hierarchical clustering
395 Citations2006Latifur Khan, Mamoun Awad +1 more
This paper presents a new approach of combination of SVM and DGSOT, which starts with an initial training set and expands it gradually using the clustering structure produced by the D GSOT algorithm, which has proved to overcome the drawbacks of traditional hierarchical clustering algorithms.
Pattern RecognitionA triangle area based nearest neighbors approach to intrusion detection
246 Citations2009Chih‐Fong Tsai, Chia-Ying Lin
A hybrid learning model based on the triangle area based nearest neighbors (TANN) in order to detect attacks more effectively and provide higher accuracy and detection rates and the lower false alarm rate than three baseline models based on support vector machines, k-NN, and the hybrid centroid-based classification model by combining k-means and k-nn.
Pattern RecognitionGenetic-fuzzy rule mining approach and evaluation of feature selection techniques for anomaly intrusion detection
219 Citations2007Chi-Ho Tsang, Sam Kwong +1 more
The extensive experimental results demonstrate that the proposed approach produces interpretable fuzzy systems, and outperforms other classifiers and wrappers by providing the highest detection accuracy for intrusion attacks and low false alarm rate for normal network traffic with minimized number of features.
Computers & SecurityAn active learning based TCM-KNN algorithm for supervised network intrusion detection
175 Citations2007Yang Li, Li Guo
A novel supervised network intrusion detection method based on TCM-KNN (Transductive Confidence Machines for K-Nearest Neighbors) machine learning algorithm and active learning based training data selection method that can effectively detect anomalies with high detection rate, low false positives and can be further optimized as discussed in this paper for real applications.
Pattern Recognition LettersDesign of multiple-level hybrid classifier for intrusion detection system using Bayesian clustering and decision trees
150 Citations2008Cheng Xiang, Png Chin Yong +1 more
Performance of this new algorithm is compared to other popular approaches such as MADAM ID and 3-level tree classifiers, and significant improvement has been achieved from the viewpoint of both high intrusion detection rate and reasonably low false alarm rate.
Computers & SecurityBuilding lightweight intrusion detection system using wrapper-based feature selection mechanisms
105 Citations2009Yang Li, Junli Wang +3 more
A wrapper-based feature selection algorithm aiming at building lightweight intrusion detection system by using modified random mutation hill climbing (RMHC) as search strategy to specify a candidate subset for evaluation and using modified linear Support Vector Machines iterative procedure as wrapper approach to obtain the optimum feature subset.
Identifying intrusions in computer networks with principal component analysis
103 Citations2006W. Wang, Roberto Battiti
A novel method for intrusion identification in computer networks based on principal component analysis (PCA), which is tested with network data from MIT Lincoln labs for the 1998 DARPA intrusion detection evaluation program and testing results show that the model is promising in terms of identification accuracy and computational efficiency.
Expert Systems with ApplicationsAn adaptive genetic-based signature learning system for intrusion detection
72 Citations2009Kamran Shafi, Hussein A. Abbass
A biologically-inspired computational approach to dynamically and adaptively learn signatures for network intrusion detection using a supervised learning classifier system that adaptively extracts signatures to the knowledge base as they are discovered by the classifier.
Lecture notes in computer scienceModeling Intrusion Detection Systems Using Linear Genetic Programming Approach
71 Citations2004Srinivas Mukkamala, Andrew H. Sung +1 more
It is found that, with appropriately chosen population size, program size, crossover rate and mutation rate, linear genetic programs could outperform support vector machines and neural networks in terms of detection accuracy.
2006 International Conference on Hybrid Information TechnologyAnomaly-Based Intrusion Detection using Fuzzy Rough Clustering
65 Citations2006Witcha Chimphlee, Abdul Hanan Abdullah +3 more
International Conference on Hybrid Information TechnologyAnomaly-Based Intrusion Detection using Fuzzy Rough Clustering
58 Citations2006Witcha Chimphlee, Abdul Hanan Abdullah +3 more
FRCM integrates the advantage of fuzzy set theory and rough set theory that the improved algorithm to network intrusion detection and outperforms the existing unsupervised intrusion detection methods.
Computer NetworksCARRADS: Cross layer based adaptive real-time routing attack detection system for MANETS
23 Citations2009John Felix Charles Joseph, A. Das +2 more
Using some innovative techniques the computational overhead of incremental update is reduced by a factor of 20 to 30 times at the cost of a negligible decrease in detection accuracy, which makes CARRADS a viable approach for real-time IDS in ad hoc networks.