Intrusion detection using SVM

Wu Liu,Ping Ren,Ke Liu,Duan Hai-xin

DOI: https://doi.org/10.1109/wicom.2011.6040153

2011-01-01

Abstract:This paper considers anomaly detection using an improved probabilistic neural networks. We first introduce a Basic Adaptive Boost Algorithm (BABA) and analysis its drawbacks and then introduce an Improved Adaptive Boost Algorithm (IABA) to classify the detected event as normal or intrusive. © 2011 IEEE.

What problem does this paper attempt to address?

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Haifeng Lv,Xiaoyu Ji,Yong Ding

DOI: https://doi.org/10.1088/1742-6596/2517/1/012016

2023-01-01

Journal of Physics Conference Series

Abstract:The intrusion detection system (IDS) plays an important part because it offers an efficient way to prevent and mitigate cyber attacks. Numerous deep learning methods for intrusion anomaly detection have been developed as a result of recent advances in artificial intelligence (AI) in order to strengthen internet security. The balance among the high detection rate (DR), the low false alarm rate (FAR) and disaster of dimensionality is the crucial apprehension while devising an effective IDS. For the binary classification of intrusion detection systems, we present in this study a mixed model called K-means-XGBoost consisting of K-means and (Extreme Gradient Boosting, XGBoost) algorithms. The distributed computation of our method is achieved in Spark platform to rapidly separate normal events and anomaly events. In phrases of accuracy, DR, F1-score, recall, precision, and error indices FAR, the proposed model’s performance is measured via the well-known dataset of NSL-KDD. The experimental outcomes indicate that our method is outstandingly better among accuracy, DR, F1-score, training time, and processing speed, compared to other models which are recently created. In particular, the accuracy, F1-score, and DR of the proposed model can achieve as high as 93.28%, 94.39%, and 99.22% in the NSL-KDD dataset, respectively.
IABA: An improved PNN Algorithm for anomaly detection in network security management

Wu Liu,Hai-Xin Duan,Ping Ren,Jianping Wu

DOI: https://doi.org/10.1109/ICNC.2010.5583161

2010-01-01

Abstract:Anomaly Detection is very difficult in network security management. In this paper, we consider anomaly detection using an improved probabilistic neural networks. We first introduce a Basic Adaptive Boost Algorithm (BABA) and analysis its drawbacks and then introduce an Improved Adaptive Boost Algorithm (IABA) to classify the detected event as normal or intrusive.
A Novel Intrusion Detection System Based on an Optimal Hybrid Kernel Extreme Learning Machine

Lu Lv,Wenhai Wang,Zeyin Zhang,Xinggao Liu

DOI: https://doi.org/10.1016/j.knosys.2020.105648

IF: 8.139

2020-01-01

Knowledge-Based Systems

Abstract:Intrusion detection is a challenging technology in the area of cyberspace security for protecting a system from malicious attacks. A novel accurate and effective misuse intrusion detection system that relies on specific attack signatures to distinguish between normal and malicious activities is therefore presented to detect various attacks based on an extreme learning machine with a hybrid kernel function (HKELM). First, the derivation and proof of the proposed hybrid kernel are given. A combination of the gravitational search algorithm (GSA) and differential evolution (DE) algorithm is employed to optimize the parameters of HKELM, which improves its global and local optimization abilities during prediction attacks. In addition, the kernel principal component analysis (KPCA) algorithm is introduced for dimensionality reduction and feature extraction of the intrusion detection data. Then, a novel intrusion detection approach, KPCA-DEGSA-HKELM, is obtained. The proposed approach is eventually applied to the classic benchmark KDD99 dataset, the real modern UNSW-NB15 dataset and the industrial intrusion detection dataset from the Tennessee Eastman process. The numerical results validate both the high accuracy and the time-saving benefit of the proposed approach.
Novel Intrusion Detection using Probabilistic Neural Network and Adaptive Boosting

Tich Phuoc Tran,Longbing Cao,Dat Tran,Cuong Duc Nguyen

DOI: https://doi.org/10.48550/arXiv.0911.0485

2009-11-03

Abstract:This article applies Machine Learning techniques to solve Intrusion Detection problems within computer networks. Due to complex and dynamic nature of computer networks and hacking techniques, detecting malicious activities remains a challenging task for security experts, that is, currently available defense systems suffer from low detection capability and high number of false alarms. To overcome such performance limitations, we propose a novel Machine Learning algorithm, namely Boosted Subspace Probabilistic Neural Network (BSPNN), which integrates an adaptive boosting technique and a semi parametric neural network to obtain good tradeoff between accuracy and generality. As the result, learning bias and generalization variance can be significantly minimized. Substantial experiments on KDD 99 intrusion benchmark indicate that our model outperforms other state of the art learning algorithms, with significantly improved detection accuracy, minimal false alarms and relatively small computational complexity.

Neural and Evolutionary Computing,Machine Learning
Real-time intrusion detection system based on one-class SVM

Qian Huang,Zhen Wang,Tao Wei,Yu Chen

2006-01-01

Abstract:This paper presents an algorithm for intrusion detection, based on one-class support vector machine (SVM) and online training of SVM. The algorithm formulates intrusion detection as a one-class classification problem. The model-building part of the algorithm works even when the training data is noisy, and therefore compared with regular SVM algorithms, it imposes fewer requirements on the training set and has a higher detection rate. For the testing data containing new types of attack, the algorithm can add such data to the training set and update the training result real-time. It tests the algorithm on KDD CUP' 99 benchmark data set for intrusion detection and the result shows that the algorithm is able to shorten the training time, and in the same time, obtain a high detection rate.
The Detection of Network Intrusion Based on Improved Adaboost Algorithm

Quanmin Wang,Xuan Wei

DOI: https://doi.org/10.1145/3377644.3377660

2020-01-10

Abstract:Network intrusion detection is a detection technology which is based on the characteristics of network behavior. In recent years, network intrusion detection, as a research focus in the field of information security, had a rapid development. Redundant and irrelevant features in data have caused a long-term problem in network traffic classification. These features not only slow down the process of classification but also prevent a classifier from making accurate decisions, especially when coping with big data. In this paper, an improved binary particle swarm optimization (BPSO) was proposed to remove redundant features. This method can compress data volumes and reduce the detection time. On this basis, weight adjustment strategies of Adaboost algorithm are improved to alleviate the phenomenon of over-fitting. The performance of the improved Adaboost classifier is evaluated using two intrusion detection evaluation datasets, namely KDD Cup 99 and NSL-KDD dataset. The evaluation results show that our approach has lower false alarm rate, higher accuracy rate and F-Score.
A Novel SVM by Combining Kernel Principal Component Analysis and Improved Chaotic Particle Swarm Optimization for Intrusion Detection

Fangjun Kuang,Siyang Zhang,Zhong Jin,Weihong Xu

DOI: https://doi.org/10.1007/s00500-014-1332-7

IF: 3.732

2014-01-01

Soft Computing

Abstract:A novel support vector machine (SVM) model by combining kernel principal component analysis (KPCA) with improved chaotic particle swarm optimization (ICPSO) is proposed to deal with intrusion detection. The proposed method, in which multi-layer SVM classifier is employed to estimate whether the action is an attack, KPCA is applied as a preprocessor of SVM to reduce the dimension of feature vectors and shorten training time. To shorten the training time and improve the performance of SVM, N-RBF is employed to reduce the noise generated by feature differences, and ICPSO is presented to optimize the punishment factor C, kernel parameters \(\sigma \) and the tube size \(\varepsilon \) of SVM, which introduces chaos optimization and premature processing mechanism. Experimental results illustrate that the improved SVM model has faster computational time and higher predictive accuracy, and it can also shorten the training time and improve the performance of SVM.
An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection

Shih-Wei Lin,Kuo-Ching Ying,Chou-Yuan Lee,Zne-Jung Lee

DOI: https://doi.org/10.1016/j.asoc.2012.05.004

IF: 8.7

2012-10-01

Applied Soft Computing

Abstract:Intrusion detection system (IDS) is to monitor the attacks occurring in the computer or networks. Anomaly intrusion detection plays an important role in IDS to detect new attacks by detecting any deviation from the normal profile. In this paper, an intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection is proposed. The key idea is to take the advantage of support vector machine (SVM), decision tree (DT), and simulated annealing (SA). In the proposed algorithm, SVM and SA can find the best selected features to elevate the accuracy of anomaly intrusion detection. By analyzing the information from using KDD’99 dataset, DT and SA can obtain decision rules for new attacks and can improve accuracy of classification. In addition, the best parameter settings for the DT and SVM are automatically adjusted by SA. The proposed algorithm outperforms other existing approaches. Simulation results demonstrate that the proposed algorithm is successful in detecting anomaly intrusion detection.

computer science, artificial intelligence, interdisciplinary applications
A New Intelligent Intrusion Detection Method Based on Attribute Reduction and Parameters Optimization of SVM

Huaping Liu,Yin Jian,Sijia Liu

DOI: https://doi.org/10.1109/etcs.2010.210

2010-01-01

Abstract:Intelligent algorithms applied in intrusion detection system has become a tendency in recent years. An intelligent intrusion detection method is presented, based on rough set theory (RST) and improved binary particle swarm optimization with supported vector machine (IBPSO-SVM), which is combined attribute reduction with parameters optimization. Experiments on KDD CUP'99 dataset show this method can be an effective way for intrusion detection, not only accelerating the training time, but also improving the accuracy of test.
Intrusion Detection System Based on One-Class Support Vector Machine and Gaussian Mixture Model

Chao Wang,Yunxiao Sun,Sicai Lv,Chonghua Wang,Hongri Liu,Bailing Wang

DOI: https://doi.org/10.3390/electronics12040930

IF: 2.9

2023-02-13

Electronics

Abstract:Intrusion detection systems (IDSs) play a significant role in the field of network security, dealing with the ever-increasing number of network threats. Machine learning-based IDSs have attracted a lot of interest owing to their powerful data-driven learning capabilities. However, it is challenging to train the supervised learning algorithms when there are no attack data at hand. Semi-supervised anomaly detection algorithms, which train the model with only normal data, are more suitable. In this study, we propose a novel semi-supervised anomaly detection-based IDS that leverages the capabilities of representation learning and two anomaly detectors. In detail, the autoencoder (AE) is applied to extract representative features of normal data in the first step, and then two semi-supervised detectors, the one-class support vector machine (OCSVM) and Gaussian mixture model (GMM), are trained on the derived features. The two detectors collaborate to detect anomalous samples. The OCSVM predicts the abnormal samples initially, and after that, the GMM is applied to recheck the misclassified samples further. The experiments demonstrate that the AE improves the detection rate, and two detectors are more promising than a single one.

engineering, electrical & electronic,computer science, information systems,physics, applied
AdaBoost-Based Algorithm for Network Intrusion Detection

Weiming Hu,Wei Hu,Steve Maybank

DOI: https://doi.org/10.1109/tsmcb.2007.914695

2005-01-01

Abstract:Network intrusion detection aims at distinguishing the attacks on the Internet from normal use of the Internet. It is an indispensable part of the information security system. Due to the variety of network behaviors and the rapid development of attack fashions, it is necessary to develop fast machine-learning-based intrusion detection algorithms with high detection rates and low false-alarm rates. In this correspondence, we propose an intrusion detection algorithm based on the AdaBoost algorithm. In the algorithm, decision stumps are used as weak classifiers. The decision rules are provided for both categorical and continuous features. By combining the weak classifiers for continuous features and the weak classifiers for categorical features into a strong classifier, the relations between these two different types of features are handled naturally, without any forced conversions between continuous and categorical features. Adaptable initial weights and a simple strategy for avoiding overfitting are adopted to improve the performance of the algorithm. Experimental results show that our algorithm has low computational complexity and error rates, as compared with algorithms of higher computational complexity, as tested on the benchmark sample data.
A method of SVM with Normalization in Intrusion Detection

Weijun li,Zhenyu Liu

DOI: https://doi.org/10.1016/j.proenv.2011.12.040

2011-01-01

Procedia Environmental Sciences

Abstract:Network intrusion is always hidden in a mass of routine data and the differences between these data are very large. Normalization can help to speed up the learning phase and avoiding numerical problems such as precision loss from arithmetic overflows. Some normalization methods are analyzed and simulated. Experiments results show that the method using SVM with normalization has much better performance compared to the method using SVM without normalization in classing intrusion data of KDD99 and Min-Max Normalization has better performance in speed, accuracy of cross validation and quantity of support vectors than other normalization methods.

English Else
SVM Classification-Based Intrusion Detection System

陈光英,张千里,李星

DOI: https://doi.org/10.3321/j.issn:1000-436x.2002.05.010

2002-01-01

Abstract:An intrusion detection system based on SVM classification technique was designed and implemented. It uses the technique of support vector machine to recognize TCP network connections without the reference of the port numbers. If a connection is recognized in a category that is different from the type of service characterized by the port number, then the connection is considered abnormal. This paper also focused on how the trace time, the feature set size and the kernel function of SVM affect the recognition error rate. Results from preliminary experiments show that our system can detect abnormal TCP network connections.
Analysis of Support Vector Machine-based Intrusion Detection Techniques

Bhoopesh Singh Bhati,C. S. Rai

DOI: https://doi.org/10.1007/s13369-019-03970-z

IF: 2.807

2019-07-02

Arabian Journal for Science and Engineering

Abstract:From the last few decades, people do various transaction activities like air ticket reservation, online banking, distance learning, group discussion and so on using the internet. Due to explosive growth of information exchange and electronic commerce in the recent decade, there is a need to implement some security mechanisms in order to protect sensitive information. Detection of any intrusive behavior is one of the most important activity for protecting our data and assets. Various intrusion detection systems are incorporated in the network for detecting intrusive behavior. In this paper, an analytical study of support vector machine (SVM)-based intrusion detection techniques is presented. Here, the methodology involves four major steps, namely, data collection, preprocessing, SVM technique for training and testing and decision. The simulated results have been analyzed based on overall detection accuracy, Receiver Operating Characteristic and (ROC) Confusion Matrix. NSL-KDD dataset is used to analyze the performance of SVM techniques. NSL-KDD dataset is a benchmark for intrusion detection technique and contains huge amount of network records. The analyzed results show that Linear SVM, Quadratic SVM, Fine Gaussian SVM and Medium Gaussian SVM give 96.1%, 98.6%, 98.7% and 98.5% overall detection accuracy, respectively.

multidisciplinary sciences
An efficient anomaly detection algorithm for vector-based intrusion detection systems

Hong-Wei Sun,Kwok-Yan Lam,Siu-Leung Chung,Ming Gu,Jia-Guang Sun

DOI: https://doi.org/10.1007/11534310_86

2005-01-01

Abstract:This paper proposes a new algorithm that improves the efficiency of the anomaly detection stage of a vector-based intrusion detection scheme. In general, intrusion detection schemes are based on the hypothesis that normal system/user behaviors are consistent and can be characterized by some behavior profiles such that deviations from the profiles are considered abnormal. In complicated computing environments, users may exhibit complicated usage patterns that the user profiles have to be established using sophisticated classification methods such as vector quantization (VQ) technique. However, anomaly detection based on the data set in a high dimension space is inefficient. In this paper we focus on the design of an algorithm that uses principal component analysis (PCA) to improve the anomaly detection efficiency. The main contribution of this research is to demonstrate how the efficiency of the anomaly detection can be raised while the effectiveness of the detection in terms of low false alarm rate and high detection rate can be maintained.
Anomaly-Based Intrusion Detection System Design Using Machine Learning Methods

U. Hacizade,A.Y. Kalayci

DOI: https://doi.org/10.1109/ET63133.2024.10721523

2024-09-17

Abstract:In this study, studies on intrusion detection systems have been meticulously examined and an example model of the intrusion detection system has been created. The UNSW-NB15 data set used in this process was subjected to training and testing stages with machine learning methods such as Logistic Regression, K-nearest Neighbor Algorithm, Support Vector Machines, Naive Bayes, Decision Tree and Random Forest Algorithm. By applying machine learning methods to the data used in the training phase, normal network traffic was taught and a reference model was created with this information.

Engineering,Computer Science
Intrusion Detection Systems Using Adaptive Regression Splines

Srinivas Mukkamala,Andrew H. Sung,Ajith Abraham,Vitorino Ramos

DOI: https://doi.org/10.48550/arXiv.cs/0405016

IF: 14.4

2004-05-05

Artificial Intelligence

Abstract:Past few years have witnessed a growing recognition of intelligent techniques for the construction of efficient and reliable intrusion detection systems. Due to increasing incidents of cyber attacks, building effective intrusion detection systems (IDS) are essential for protecting information systems security, and yet it remains an elusive goal and a great challenge. In this paper, we report a performance analysis between Multivariate Adaptive Regression Splines (MARS), neural networks and support vector machines. The MARS procedure builds flexible regression models by fitting separate splines to distinct intervals of the predictor variables. A brief comparison of different neural network learning algorithms is also given.
Use Dimensionality Reduction and SVM Methods to Increase the Penetration Rate of Computer Networks

Amir Moradibaad,Ramin Jalilian Mashhoud

DOI: https://doi.org/10.48550/arXiv.1812.03173

2018-12-13

Abstract:In the world today computer networks have a very important position and most of the urban and national infrastructure as well as organizations are managed by computer networks, therefore, the security of these systems against the planned attacks is of great importance. Therefore, researchers have been trying to find these vulnerabilities so that after identifying ways to penetrate the system, they will provide system protection through preventive or countermeasures. SVM is one of the major algorithms for intrusion detection. In this research, we studied a variety of malware and methods of intrusion detection, provide an efficient method for detecting attacks and utilizing dimension <a class="link-external link-http" href="http://reduction.Thus" rel="external noopener nofollow">this http URL</a>, we will be able to detect attacks by carefully combining these two algorithms and pre-processes that are performed before the two on the input data. The main question raised is how we can identify attacks on computer networks with the above-mentioned method. In anomalies diagnostic method, by identifying behavior as a normal behavior for the user, the host, or the whole system, any deviation from this behavior is considered as an abnormal behavior, which can be a potential occurrence of an attack. The network intrusion detection system is used by anomaly detection method that uses the SVM algorithm for classification and SVD to reduce the size. Steps of the proposed method include pre-processing of the data set, feature selection, support vector machine, and <a class="link-external link-http" href="http://evaluation.The" rel="external noopener nofollow">this http URL</a> NSL-KDD data set has been used to teach and test the proposed model. In this study, we inferred the intrusion detection using the SVM algorithm for classification and SVD for diminishing dimensions with no classification <a class="link-external link-http" href="http://algorithm.Also" rel="external noopener nofollow">this http URL</a> the KNN algorithm has been compared in situations with and without diminishing dimensions,the results have shown that the proposed method has a better performance than comparable methods.

Cryptography and Security,Machine Learning
Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network

Yanqing Yang,Kangfeng Zheng,Chunhua Wu,Yixian Yang

DOI: https://doi.org/10.3390/s19112528

IF: 3.9

2019-06-02

Sensors

Abstract:Intrusion detection systems play an important role in preventing security threats and protecting networks from attacks. However, with the emergence of unknown attacks and imbalanced samples, traditional machine learning methods suffer from lower detection rates and higher false positive rates. We propose a novel intrusion detection model that combines an improved conditional variational AutoEncoder (ICVAE) with a deep neural network (DNN), namely ICVAE-DNN. ICVAE is used to learn and explore potential sparse representations between network data features and classes. The trained ICVAE decoder generates new attack samples according to the specified intrusion categories to balance the training data and increase the diversity of training samples, thereby improving the detection rate of the imbalanced attacks. The trained ICVAE encoder is not only used to automatically reduce data dimension, but also to initialize the weight of DNN hidden layers, so that DNN can easily achieve global optimization through back propagation and fine tuning. The NSL-KDD and UNSW-NB15 datasets are used to evaluate the performance of the ICVAE-DNN. The ICVAE-DNN is superior to the three well-known oversampling methods in data augmentation. Moreover, the ICVAE-DNN outperforms six well-known models in detection performance, and is more effective in detecting minority attacks and unknown attacks. In addition, the ICVAE-DNN also shows better overall accuracy, detection rate and false positive rate than the nine state-of-the-art intrusion detection methods.

engineering, electrical & electronic,chemistry, analytical,instruments & instrumentation

Intrusion detection using SVM

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

IABA: An improved PNN Algorithm for anomaly detection in network security management

A Novel Intrusion Detection System Based on an Optimal Hybrid Kernel Extreme Learning Machine

Novel Intrusion Detection using Probabilistic Neural Network and Adaptive Boosting

Real-time intrusion detection system based on one-class SVM

The Detection of Network Intrusion Based on Improved Adaboost Algorithm

A Novel SVM by Combining Kernel Principal Component Analysis and Improved Chaotic Particle Swarm Optimization for Intrusion Detection

An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection

A New Intelligent Intrusion Detection Method Based on Attribute Reduction and Parameters Optimization of SVM

Intrusion Detection System Based on One-Class Support Vector Machine and Gaussian Mixture Model

AdaBoost-Based Algorithm for Network Intrusion Detection

A method of SVM with Normalization in Intrusion Detection

SVM Classification-Based Intrusion Detection System

Analysis of Support Vector Machine-based Intrusion Detection Techniques

An efficient anomaly detection algorithm for vector-based intrusion detection systems

Anomaly-Based Intrusion Detection System Design Using Machine Learning Methods

Intrusion Detection Systems Using Adaptive Regression Splines

Use Dimensionality Reduction and SVM Methods to Increase the Penetration Rate of Computer Networks

Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network