A new data mining based network Intrusion Detection model

Gudadhe, Mrudula; Prasad, Prakash S.; Wankhade, Kapil

doi:10.1109/iccct.2010.5640375

Cited by 45 publications

(18 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Intrusion detection is a process of gathering intrusion-related knowledge occurring in the process of monitoring events and analyzing them for signs of intrusion [1]. There are two basic IDS approaches: misuse detection (signature-based) and anomaly detection.…”

Section: Intrusion Detection Systemmentioning

confidence: 99%

See 1 more Smart Citation

Application of Bagging, Boosting and Stacking to Intrusion Detection

Syarif

Zaluska

Prügel-Bennett

et al. 2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. This paper investigates the possibility of using ensemble algorithms to improve the performance of network intrusion detection systems. We use an ensemble of three different methods, bagging, boosting and stacking, in order to improve the accuracy and reduce the false positive rate. We use four different data mining algorithms, naïve bayes, J48 (decision tree), JRip (rule induction) and iBK( nearest neighbour), as base classifiers for those ensemble methods. Our experiment shows that the prototype which implements four base classifiers and three ensemble algorithms achieves an accuracy of more than 99% in detecting known intrusions, but failed to detect novel intrusions with the accuracy rates of around just 60%. The use of bagging, boosting and stacking is unable to significantly improve the accuracy. Stacking is the only method that was able to reduce the false positive rate by a significantly high amount (46.84%); unfortunately, this method has the longest execution time and so is insufficient to implement in the intrusion detection field.Keywords: Intrusion Detection System, bagging, boosting, stacking, ensemble classifiers Intrusion Detection SystemIntrusion detection is a process of gathering intrusion-related knowledge occurring in the process of monitoring events and analyzing them for signs of intrusion [1]. There are two basic IDS approaches: misuse detection (signature-based) and anomaly detection. The misuse detection system uses patterns of well-known attacks to match and identify known intrusions. It performs pattern matching between the captured network traffic and attack signatures. If a match is detected, the system generates an alarm. The main advantage of the signature detection paradigm is that it can accurately detect instances of known attacks. The main disadvantage is that it lacks the ability to detect new intrusions or zero-day attacks [16] [17]. The anomaly detection model works by identifying an attack by looking for behaviour that is out of the normal. It establishes a baseline model of behaviour for users and components in a computer or network. Deviations from the baseline cause alerts that direct the attention of human operators to the anomalies [17][18]. This system

show abstract

Section: Intrusion Detection Systemmentioning

confidence: 99%

“…In order to achieve a higher accuracy and lower false positive rate, many data mining researchers have proposed various ensemble learning approaches. It is well known in the data mining literature that the appropriate combination of a number of weak classifiers can yield a highly accurate global classifier [1].…”

Section: Data Mining For Idsmentioning

confidence: 99%

Application of Bagging, Boosting and Stacking to Intrusion Detection

Syarif

Zaluska

Prügel-Bennett

et al. 2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Boosted decision tree approach [24] for intrusion detection system is an ensemble approach and its detection rate is fine but has moderate false alarm rate. Because it combines a number of decision trees, it becomes complex and needs more time and space.…”

Section: Discussionmentioning

confidence: 99%

Intrusion Detection System: A Review

Sharma¹,

Gupta²

2015

IJSIA

View full text Add to dashboard Cite

show abstract

“…Mrudula Gudadhe et al [27] proposed new ensemble boosted decision tree approach for intrusion detection system. The proposed boosted decision trees algorithm was tested on 10% of KDDCup'99 dataset with 12 features and compared to that of a Naïve Bayes, k-NN, eClass0, eClass1 and the Winner (KDDCup'99) in terms of accuracy or detection rate.…”

Section: Fig 5: Combining the Accuracy Of Claasifiersmentioning

confidence: 99%

Classification Techniques for Intrusion Detection An Overview

Amudha¹,

Karthik²,

Sivakumari³

2013

IJCA

View full text Add to dashboard Cite

Security is becoming a critical part of organizational information systems and security of a computer system or network is compromised when an intrusion takes place. In the field of computer networks security, the detection of threats or attacks is nowadays a critical problem to solve. Intrusion Detection Systems (IDS) have become a standard component in network security infrastructures and is an essential mechanism to protect computer systems from many attacks. In recent years, intrusion detection using data mining have attracted researchers more and more interests. Different researchers propose a different algorithm in different categories. Classifier construction is another research challenge to build an efficient intrusion detection system. KDDCup 1999 intrusion detection dataset plays a key role in fine tuning intrusion detection system and is most widely used by the researchers working in the field of intrusion detection. This paper presents an overview of intrusion detection, KDDCup'99 dataset and detailed analysis of classification techniques used in intrusion detection.

show abstract

A new data mining based network Intrusion Detection model

Cited by 45 publications

References 8 publications

Application of Bagging, Boosting and Stacking to Intrusion Detection

Application of Bagging, Boosting and Stacking to Intrusion Detection

Intrusion Detection System: A Review

Classification Techniques for Intrusion Detection An Overview

Contact Info

Product

Resources

About