Multi-level hybrid support vector machine and extreme learning machine based on modified K-means for intrusion detection system

Al-Yaseen, Wathiq Laftah; Othman, Zulaiha Ali; Nazri, Mohd Zakree Ahmad

doi:10.1016/j.eswa.2016.09.041

Cited by 381 publications

(181 citation statements)

References 19 publications

Supporting

Mentioning

170

Contrasting

Order By: Relevance

“…Thereafter, the top-ranked flows are considered as anomalies on the basis of a thresholding approach. The approach proposed by Casas et al [29] displayed a better performance in comparison with other unsupervised anomaly detection methods such as DBSCAN, k-means, and PCA. However, since it extracts some TCP flags such as SYN, it may not be appropriate for the SDN case due to the fact that dealing with flows is more fast and efficient than handling each packet separately.…”

Section: Related Workmentioning

confidence: 96%

See 1 more Smart Citation

Towards an efficient anomaly‐based intrusion detection for software‐defined networks

Latah

Toker

2018

IET Networks

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is a novel networking paradigm that provides enhanced programming abilities, which can be used to solve traditional security challenges on the basis of more efficient approaches. The most important element in the SDN paradigm is the controller, which is responsible for managing the flows of each correspondence forwarding element (switch or router). Flow statistics provided by the controller are considered to be useful information that can be used to develop a network-based intrusion detection system. Therefore, in this paper, we propose a 5-level hybrid classification system based on flow statistics in order to attain an improvement in the overall accuracy of the system. For the first level, we employ the k-Nearest Neighbor approach (kNN); for the second level, we use the Extreme Learning Machine (ELM); and for the remaining levels, we utilize the Hierarchical Extreme Learning Machine (H-ELM) approach. In comparison with conventional supervised machine learning algorithms based on the NSL-KDD benchmark dataset, the experimental study showed that our system achieves the highest level of accuracy (84.29%). Therefore, our approach presents an efficient approach for intrusion detection in SDNs.

show abstract

Section: Related Workmentioning

confidence: 96%

“…Al-Yaseen el al. [29] proposed a multi-level hybrid system on the basis of SVM and ELM. Based on experimental results conducted on the KDD Cup 99 dataset, the system showed high accuracy (95.75%) and low false alarm rate (1.87%).…”

Section: Related Workmentioning

confidence: 99%

Towards an efficient anomaly‐based intrusion detection for software‐defined networks

Latah

Toker

2018

IET Networks

View full text Add to dashboard Cite

show abstract

“…In this paper [7], an author presented a technique based on the Online Sequential Extreme Learning Machine (OS-ELM). In this paper [8], an author presented a multilevel hybrid intrusion detection model using a combination of K-means, SVM, as well as ELM algorithms. In this paper [9], an author used a multi-objective particle swarm optimization algorithm for feature selection.…”

Section: Literature Reviewmentioning

confidence: 99%

Anomaly Web-based Intervention Disclosure Structure using a Steady Hybrid Feature Selection and AdaBoost Algorithms

Solanki¹

2018

IJRASET

View full text Add to dashboard Cite

All the features in a dataset are not crucial in consideration some are either redundant or irrelevant. An effective dimensionality reduction technique is feature selection. It is needed for clustering of web document. The primary relevance of a safe network is Intrusion detection system. The is false alarm report of intrusion to the network as well as intrusion detection accuracy that happens due to the huge size of network data are problems of these security systems. This paper comes up with a new reliable hybrid method for an anomaly network-based IDS using Hybrid Feature selection as well as AdaBoost algorithms. They are used to achieve a high detection rate (DR) with low false positive rate (FPR). Hybrid Feature selection algorithm is used for feature selection. AdaBoost are used not only to evaluate but also to categories the features. The simulation result on NSL-KDD dataset makes sure that this reliable hybrid method has a compelling divergence from other IDS. The accuracy as well as detection rate of this method has been improved in comparison with legendary methods. Keywords: Hybrid Feature Selection, AdaBoost , Anomaly IDS, Network IDS, Dataset. I. INTRODUCTIONThis with the fast growth of information technology as well as network, people can grab more data from the network. The data characteristics dimension is becoming more and more. The classification accuracy of the intrusion detection is improved by the comprehensive information of the data. The security of network activities highly considered in the computer networks due to increase in Internet attacks. all abnormal patterns as well as should be identified by an IDS. It uses monitoring, detecting as well as responding to unauthorized activities within the system. The data is categorized into two main classes such as network-based as well as host-based. All packets in the network are checked by network-based IDS. This detection system can monitor traffic only on a specific part of the network. Host-based IDS is set up on either a local machine or system to collect information about machine host activities. In misuse detection method, the detection system tries to identify the patterns similar to patterns which are present in the database. It also finds out the known intrusions. In such a scenario, new attacks cannot be detected in the network because of no patterns exist in a database [3]. As a result, this method has high-accuracy rate as well as low false alarm rate. The decisions are made based on network normal behavior or features in case of anomaly detection method. As shown in Fig. 1, this new approach made up of the different main component such as Different attacks selection and definition, Hybrid computer network topology design, Anomaly based IDS technique selection, appropriate algorithm selection and definition to improve anomaly network-based IDS behavior, Appropriate dataset selection.

show abstract

“…KNN algorithm [17] is widely used in pattern recognition, classification, and regression. Same as KNN, vector automatic classification algorithms, support vector machine [18][19][20], neural network algorithm [21], Bayesian algorithm [22][23][24], and means algorithm are also widely used for IDS [25,26].…”

Section: Introductionmentioning

confidence: 99%

Intrusion Detection System Based on Decision Tree over Big Data in Fog Environment

Peng

Leung

Zheng

et al. 2018

Wireless Communications and Mobile Computing

109

View full text Add to dashboard Cite

Fog computing, as the supplement of cloud computing, can provide low-latency services between mobile users and the cloud. However, fog devices may encounter security challenges as a result of the fog nodes being close to the end users and having limited computing ability. Traditional network attacks may destroy the system of fog nodes. Intrusion detection system (IDS) is a proactive security protection technology and can be used in the fog environment. Although IDS in tradition network has been well investigated, unfortunately directly using them in the fog environment may be inappropriate. Fog nodes produce massive amounts of data at all times, and, thus, enabling an IDS system over big data in the fog environment is of paramount importance. In this study, we propose an IDS system based on decision tree. Firstly, we propose a preprocessing algorithm to digitize the strings in the given dataset and then normalize the whole data, to ensure the quality of the input data so as to improve the efficiency of detection. Secondly, we use decision tree method for our IDS system, and then we compare this method with Naïve Bayesian method as well as KNN method. Both the 10% dataset and the full dataset are tested. Our proposed method not only completely detects four kinds of attacks but also enables the detection of twenty-two kinds of attacks. The experimental results show that our IDS system is effective and precise. Above all, our IDS system can be used in fog computing environment over big data.

show abstract

Multi-level hybrid support vector machine and extreme learning machine based on modified K-means for intrusion detection system

Cited by 381 publications

References 19 publications

Towards an efficient anomaly‐based intrusion detection for software‐defined networks

Towards an efficient anomaly‐based intrusion detection for software‐defined networks

Anomaly Web-based Intervention Disclosure Structure using a Steady Hybrid Feature Selection and AdaBoost Algorithms

Intrusion Detection System Based on Decision Tree over Big Data in Fog Environment

Contact Info

Product

Resources

About