Fusions of GA and SVM for Anomaly Detection in Intrusion Detection System

Kim, Dong-Seong; Nguyen, Ha-Nam; Ohn, Syng-Yup; Park, Jong Sou

doi:10.1007/11427469_67

Cited by 41 publications

(17 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[13] 99.98 (SVM+GPC-12) [15] 99.96 (SVM+GPC-10) [15] 99.94 (SVM-FS-12) [11] 99.60 (MLP+PCA) [16] 98.57 (GA+SVM) [8] 98 (ART1) [20] 97.42 (ART2) [20] 97.19 (SOM) [20] 95.74 (RBF/Elman) [19] 93 (PCA+NN) [18] 92.2 (SVM) [17] 83.2 (MLP) [17] 82.5 principal components. The feature selection has been accomplished using the techniques of PCA and GA. PCA, in this case, was applied to transform the input samples into a new feature space.…”

Section: Resultsmentioning

confidence: 99%

Enhancing MLP Performance in Intrusion Detection using Optimal Feature Subset Selection based on Genetic Principal Components

Ahmad¹

2014

Appl. Math. Inf. Sci.

View full text Add to dashboard Cite

Abstract:Computer and network systems nowadays are facing many security issues, one of which considered important is intrusion. To prevent such intrusion, a mechanism for optimal intrusion detection is deemed necessary. A number of tools and techniques are available, yet most of them still face a main problem that is on performance. The performance, in essence, can be increased by reducing false positives and increasing accurate detection rate. What has made the performance terrible in the existing intrusion detection approaches is due to the use of a raw dataset that includes redundancy and leads the classifier to be confused. To overcome this issue, Principal Component Analysis (PCA) has been used to project a number of raw features on principal feature space and to select the features based on their sensitivity determined by the magnitude of eigenvalues. Here, only the features corresponding to the highest eigenvalues are selected; the remaining features, by contrast, are ignored. Due to the ignorance of many important and sensitive features for the classifier for their lowest eigenvalues, this method comes to be not optimal. Therefore, a suitable method is necessary to select a subset of features, which, in turn, can enhance the classifier performance. The focus of this research is to observe a space of principal features to find a subset of sensitive features to the classifier, which can optimize the detection accuracy. Genetic Algorithm (GA) has been applied to solve an optimization problem. The raw features have, afterwards, been transformed through PCA into principal features space. GA, in this case, was used to search this features space to obtain principal components called genetic principal components (GPC). The feature set obtained through this process was, in turn, presented to the classifier. The Multilayer Perceptron (MLP), meanwhile, was used for classification considering its proven ability. Additionally, Knowledge Discovery and Data mining (KDD) cup dataset was used for the validation of the proposed approach, which is considered as a benchmark to evaluate the intrusion detection approaches. The performance of this approach has been analyzed and compared with a number of existing approaches. The results then show that proposed method outperforms the existing approaches. Not only does it significantly reduce the dimension of the feature space but also improves the detection accuracy.

show abstract

Section: Resultsmentioning

confidence: 99%

Enhancing MLP Performance in Intrusion Detection using Optimal Feature Subset Selection based on Genetic Principal Components

Ahmad¹

2014

Appl. Math. Inf. Sci.

View full text Add to dashboard Cite

show abstract

“…RSVM preselects a subset of training samples as SVMs and solves a smaller Quadratic Programming problem. Moreover, Kim and Park (Kim et al, 2005;Park et al, 2005) and Makkamala et al (Ribeiro, 2005) proposed a method to optimize parameters of kernel function in SVM. All these methods yield good improvements, but they are fairly complex and computationally expensive.…”

Section: Related Workmentioning

confidence: 98%

Building lightweight intrusion detection system using wrapper-based feature selection mechanisms

Wang

Tian

et al. 2009

Computers & Security

View full text Add to dashboard Cite

“…Filter method does not use any machine learning algorithm to filter out the irrelevant and redundant features; rather, it utilizes the underlying characteristics of the training data to evaluate the relevance of the features or feature set by some independent measures such as distance, correlation, and consistency measures . In addition, some studies proposed hybrid approaches . Kim et al proposed feature selection method based on genetic algorithm.…”

Section: Background and Related Workmentioning

confidence: 99%

“…In addition, some studies proposed hybrid approaches . Kim et al proposed feature selection method based on genetic algorithm. Park et al proposed correlation‐based hybrid feature selection approach.…”

Section: Background and Related Workmentioning

confidence: 99%

Quantitative intrusion intensity assessment for intrusion detection systems

Kim

Lee

Kim

et al. 2012

Security Comm Networks

Self Cite

View full text Add to dashboard Cite

One of the main problems of existing approaches in anomaly detection in intrusion detection system (IDS) is that IDSs provide only binary detection result: intrusion (attack) or normal. If some attack data or normal data is belonged to boundary, they may be classified wrongly. That is a main cause of high false rates and inaccurate detection rates in IDS. We propose a new approach named Quantitative Intrusion Intensity Assessment (QIIA) that exploits proximity metrics computation so that it provides intrusion (or normal) quantitative intensity value. It is capable of representing how an instance of audit data is proximal to intrusion or normal in a numerical value. This can identify unknown intrusion and normal pattern more accurately. Prior to applying QIIA to audit data, we perform feature selection and parameter optimization of detection models to decrease the overheads to process audit data and to enhance detection rates. Random Forests is used to generate proximity metrics that represent the intrusion intensity (and normal instance intensity) in a numerical way. The numerical value is used to determine whether unknown audit data are intrusion or normal. We carry out several experiments on KDD 1999 dataset and the experimental results show the feasibility of our approach. Copyright © 2012 John Wiley & Sons, Ltd.

show abstract

Fusions of GA and SVM for Anomaly Detection in Intrusion Detection System

Cited by 41 publications

References 7 publications

Enhancing MLP Performance in Intrusion Detection using Optimal Feature Subset Selection based on Genetic Principal Components

Enhancing MLP Performance in Intrusion Detection using Optimal Feature Subset Selection based on Genetic Principal Components

Building lightweight intrusion detection system using wrapper-based feature selection mechanisms

Quantitative intrusion intensity assessment for intrusion detection systems

Contact Info

Product

Resources

About