MLH-IDS: A Multi-Level Hybrid Intrusion Detection Method

Abstract

With the growth of networked computers and associated applications, intrusion detection has become essential to keeping networks secure. A number of intrusion detection methods have been developed for protecting computers and networks using conventional statistical methods as well as data mining methods. Data mining methods for misuse and anomaly-based intrusion detection, usually encompass supervised, unsupervised and outlier methods. It is necessary that the capabilities of intrusion detection methods be updated with the creation of new attacks. This paper proposes a multi-level hybrid intrusion detection method that uses a combination of supervised, unsupervised and outlierbased methods for improving the efficiency of detection of new and old attacks. The method is evaluated with a captured real-time flow and packet dataset called the Tezpur University intrusion detection system (TUIDS) dataset, a distributed denial of service dataset, and the benchmark intrusion dataset called the knowledge discovery and data mining Cup 1999 dataset and the new version of KDD (NSL-KDD) dataset. Experimental results are compared with existing multi-level intrusion detection methods and other classifiers. The performance of our method is very good.

A two-level hybrid approach for intrusion detection

“…The multiple One-class SVM models are trained by disjoint normal training data subsets, which are decomposed by the misuse detection component. Furthermore, in the multi-level hybrid intrusion detection method of [17], three levels of detection respectively built by a supervised, an unsupervised and an outlier-based method are presented. In general, this type of hybrid approach is designed for a high detection rate.…”

Evaluation of machine learning classifiers for mobile malware detection

“…Thereafter, all related information was extracted using tshark (2013), which is a terminal-based version of wireshark that was used to extract 11 features from the TCP packets (Table 2). The features were chosen from numerous network features in the packet-level features of the TUIDS intrusion dataset (Gogoi 2013). Above all, the main challenge in feature selection was finding the most relevant features that led to the highest true positive rate.…”

Intrusion detection techniques for mobile cloud computing in heterogeneous 5G

“…Multiple intrusion detection approaches can be simultaneously deployed based on the security demands . The purpose of combining two or more techniques is to design new intrusion processes by taking advantages of different techniques.…”