Design of Multiple-Level Hybrid Classifier for Intrusion Detection System

A two-level hybrid approach for intrusion detection

“…Note that this comparison is provided for reference only because many researchers used different training set or preprocessing methods. As shown in Table 12, the hybrid approaches proposed in [16,22,25] reach very high DRs, but their FPRs are also relatively high (greater than or equal to 3.0%). The detection performance of the proposed hybrid approach is similar to that obtained by KDD'99 winner [30] (an ensemble of 500 decision trees) and KDD'99 runner up [29] (an ensemble of 755 detection trees).…”

“…For fairness, only the detection approaches that had used the same test set, i.e., the whole KDD'99 test set, are selected. As mentioned in Section 2, Three-tier IDS [16] can be classified as a hybrid approach based on misuse detection followed by anomaly detection; CSI-KNN [22] is a parallel hybrid approach; Multiple-level hybrid classifier [24], Multiple-level classifiers [25] and J48-BN [27] belong to layered approaches; and KDD'99 winner [29] and KDD'99 runner-up [30] are ensemble approaches. In Table 12, we list the reported results of the comparisons for the binary classes (normal and attack).…”

“…Additionally, although neither misuse detection nor anomaly detection methods are included, hybrid IDSs can also consist of methods that combine multiple machine learning techniques [23,24], e.g., staged or layered approaches [24][25][26][27][28] and ensemble approaches [29][30][31][32][33]. These alternatives are able to achieve better results than their individual detection component (usually a misuse detection component), but they are generally not very good at detecting unknown attacks.…”

An Active Rule Approach for Network Intrusion Detection with Enhanced C4.5 Algorithm

“…There are many works in the literature that deal with classification. [1,3,5,8]. Decision tree [9] is a widely used tool for classification in various domains that need to handle large data sets.…”

“…Xiang et al [8] say that intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of intrusions. For accurate intrusion detection, we must have reliable and complete data about the target system activities.…”