Anomaly Detection based on Machine Learning Dimensionality Reduction using PCA and Classification using SVM

Abstract

Anomaly detection has emerged as an important technique in many application areas mainly for network security. Anomaly detection based on machine learning algorithms considered as the classification problem on the network data has been presented here. Dimensionality reduction and classification algorithms are explored and evaluated using KDD99 dataset for network IDS. Principal Component Analysis for dimensionality reduction and Support Vector Machine for classification have been considered for the application on network data and the results are analysed. The result shows the decrease in execution time for the classification as we reduce the dimension of the input data and also the precision and recall parameter values of the classification algorithm shows that the SVM with PCA method is more accurate as the number of misclassification decreases.

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

“…Vajiheh Hajisalem et al propose a hybrid classification method based on artificial bee colony (ABC) and artificial fish swarm (AFS) algorithm [16], using fuzzy C-means clustering (FCM) and correlation-based feature selection (CFS) techniques for training data. George et al apply SVM and PCA to anomaly detection of network data [17]. It is proved that PCA can effectively improve classification effect of SVM and increase model training speed.…”

“…Basic Features state(1), dur(2), sbytes(3), dbytes(4), sttl(5), dttl (6), sloss (7), dloss (8), service (9), sload (10), dload (11), spkts (12), dpkts (13) Content Features swin (14), dwin (15), stcpb (16), dtcpb (17), smeansz (18), dmeansz (19), trans depth (20), res bdy len (21) Time Features sjit (22), djit (23), stime (24), ltime (25), sintpkt (26), dintpkt (27), tcprtt (28), synack (29), ackdat (30) Additional Generated Features is sm ips ports(31), ct state ttl(32), ct flw http mthd(33), is ftp login(34), ct ftp cmd(35), ct srv src(36), ct srv dst(37), ct dst ltm(38), ct src ltm(39), ct src dport ltm(40), ct dst sport ltm(41), ct dst src ltm(42) 8,9,10,12,13,17,19,20,22,24,25,26,27,28,29,30,34,35,38 20 Shellcode 3,4,5,…”

Intrusion detection techniques for mobile cloud computing in heterogeneous 5G

“…The comparison can determine whether there is a partition between normal and unusual behaviors, and the unusual behavior is considered as an active or potential attack, which depends on the level of differences. Three common techniques supporting comparisons include statistical‐based , knowledge‐based, and machine learning‐based techniques .…”

Non-linear Dimensionality Reduction-based Intrusion Detection using Deep Autoencoder

“…During the feature selection process the high dimensional training dataset is reduced in to low dimensional representation and the redundant features are eliminated. For selecting an optimal set of features various methods including Genetic Algorithm, meta-heuristic algorithms, and Principal Component Analysis (PCA) are used [5]. This paper utilizes a deep auto-encoder for finding a compact representation of the input data and a dense neural network for classification of anomalous traffic.…”