Anomaly detection has emerged as an important technique in many application areas mainly for network security. Anomaly detection based on machine learning algorithms considered as the classification problem on the network data has been presented here. Dimensionality reduction and classification algorithms are explored and evaluated using KDD99 dataset for network IDS. Principal Component Analysis for dimensionality reduction and Support Vector Machine for classification have been considered for the application on network data and the results are analysed. The result shows the decrease in execution time for the classification as we reduce the dimension of the input data and also the precision and recall parameter values of the classification algorithm shows that the SVM with PCA method is more accurate as the number of misclassification decreases.
Anomaly detection has been considered as a critical problem in any application area. In computer networks, anomaly detection is important as any kind of abnormal behavior in the network data is considered harmful to the end user. Snort is an open source NIDS tool that uses misuse detection method for intrusion detection. There are many pre-processor and detection plug-ins for Snort. Pre-processor plug-ins is meant to process the packet captured but some are meant for detection of anomalies also. Hence we are implementing a preprocessor plug-in for Snort meant for anomaly detection approach using the machine learning algorithm support vector machine and integrating into Snort. The anomalies detected by the plug-in are new compared with the anomalies detected by the available pre-processor plug-ins. Also we created an intrusion detection dataset which is important for any process using the machine learning algorithms. The detection rate of the plug-in is high and the false alarm rate is low which is very important for any anomaly detection system. Hence integrating this plug-in into Snort helps to improve the detection rate of the plugins that can be run in packet sniffer mode.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.