An efficient local region and clustering-based ensemble system for intrusion detection

Abstract

The dramatic proliferation of sophisticated cyber attacks, in conjunction with the ever growing use of Internet-based services and applications, is nowadays becoming a great concern in any organization. Among many efficient security solutions proposed in the literature to deal with this evolving threat, ensemble approaches, a particular family of data mining, have proven very successful in designing high performance intrusion detection systems (IDSs) resting on the mutual combination of multiple classifiers. However, the strength of ensemble systems depends heavily on the methods to generate and combine individual classifiers. In this thread, we propose a novel design method to generate a robust ensemble-based IDS. In our approach, individual classifiers are built using both the input feature space and additional features exploited from k-means clustering. In addition, the ensemble combination is calculated based on the classification ability of classifiers on different local data regions defined in form of k-means clustering. Experimental results prove that our solution is superior to several well-known methods.

A Review on Machine Learning Approaches for Network Malicious Behavior Detection in Emerging Technologies

“…The clustering technique follows a simple rule; whenever the input network instances match one of the intrusion signatures, the system reacts to the security administrator concerning the possible threat in details, one of the limitations of proposed system is the paucity of extracted features, which is a lot less compared to the features in popular datasets such as UNSW-NB15, KDD99, and NSL-KDD datasets. Although various clustering techniques have been used for NADSs, the most utilized techniques for malicious detection are regular and co-clustering techniques using different strategies and processing methods [ 9 , 65 , 66 ]. For example, the K-means, as a regular clustering method, assembles features from the dataset instances, but co-clustering techniques concurrently consider both features and instances in the dataset to make clusters.…”

Hybrid Architecture for Distributed Intrusion Detection System Using Semi-supervised Classifiers in Ensemble Approach

“…Most of the researchers are now days creating own customized dataset. Sources can be a heterogeneous in manner used for data collection [23]. Most of the sources can be log files, audit files, and packets entering in the network from various senders.…”

“…Methodology Classifiers [6] Supervised, Ensemble SVM, RF [12] Supervised, Ensemble SVM, KNN [13] Supervised, Ensemble RF, j48 [14] Supervised, DT [15] Supervised, Ensemble Multiple SVM [16] Supervised, Ensemble ANN, SVM, DT, KNN [17] Ensemble SVM, weighted majority, KNN [19] Ensemble K means and SVM [20] Supervised, Ensemble RF [21] Supervised, Ensemble Clustering, SVM [22] Supervised, Ensemble BIRCH, SVM [23] Semi-Supervised DT, weighted mean and k means clustering…”

Hybrid Intrusion Detection in Information Systems

“…Using a hybrid (combine different data mining methods) approach is very interesting because it takes care about alert management [7] [8]. H.Nguyen et al [9] use an ensemble system of classifiers, called CBE based on K-mean algorithm but the classe number must be fixed a priori [10]. This may take time depending on the number of servers to be monitored.…”