Novel statistical network model: the hyperbolic distribution

Li, J.; Manikopoulos, C.N.

doi:10.1049/ip-com:20040522

Cited by 7 publications

(4 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…by that, many researchers try to build statistical models of a host system from various aspects [11]. Data mining is also widely studied and used in intrusion detection [9,33].…”

Section: S Aljahdali / An Effective Intrusion Detection Methods Usingmentioning

confidence: 99%

An effective intrusion detection method using optimal hybrid model of classifiers

Aljahdali

2010

JCM

View full text Add to dashboard Cite

With increasing connectivity between computers, the security of computer networks plays a strategic role in modern computer systems. In order to enforce high protection levels against threats, a number of software systems have been currently developed. Intrusion detection systems (IDS) have become an essential component at detecting intruders. In this paper, an ensemble approach to network intrusion detection based on the fusion of multiple classifiers is proposed. A computational machine is built to derive optimal parsimonious hybrid model of classifiers in intrusion detection based on the following classification methods, Naïve Bayes, Support Vector Machine, K-nearest neighbor, and Neural networks. The weighted voting fusion strategy for intrusion detection is assessed by experiments and its performances compared. The potentialities of classifiers fusion for the development of effective intrusion detection systems are evaluated and discussed. The experimental results indicate that hybrid approach effectively generates a more accurate intrusion detection model on detecting both normal usages and malicious activities. In this paper, we aim to build a robust classifier combination system given a classifier set.

show abstract

“…by that, many researchers try to build statistical models of a host system from various aspects [11]. Data mining is also widely studied and used in intrusion detection [9,33].…”

Section: S Aljahdali / An Effective Intrusion Detection Methods Usingmentioning

confidence: 99%

An effective intrusion detection method using optimal hybrid model of classifiers

Aljahdali

2010

JCM

View full text Add to dashboard Cite

show abstract

“…Table III shows the detection and false-alarm rates for the training and test data sets when uniform initial weights are used and overfitting is not handled. Table IV shows the detection and false-alarm rates when overfitting is not handled, but adaptable initial weights formulated by (13) are used, where r varies from 0 to 1 with the step length of 0.1. It can be seen that, when r is neither too small nor too large, i.e., from 0.3 to 0.7, the results with adaptable initial weights are better than those with uniform initial weights.…”

Section: Methodsmentioning

confidence: 99%

“…It is assumed that the distance obeys the standard Gaussian distribution. Li and Manikopoulos [13] propose some representative parameters of IP data flow, and they model the parameters using a hyperbolic distribution.…”

Section: B Related Workmentioning

confidence: 99%

AdaBoost-Based Algorithm for Network Intrusion Detection

Maybank

2008

IEEE Trans. Syst., Man, Cybern. B

293

View full text Add to dashboard Cite

Abstract-Network intrusion detection aims at distinguishing the attacks on the Internet from normal use of the Internet. It is an indispensable part of the information security system. Due to the variety of network behaviors and the rapid development of attack fashions, it is necessary to develop fast machine-learning-based intrusion detection algorithms with high detection rates and low false-alarm rates. In this correspondence, we propose an intrusion detection algorithm based on the AdaBoost algorithm. In the algorithm, decision stumps are used as weak classifiers. The decision rules are provided for both categorical and continuous features. By combining the weak classifiers for continuous features and the weak classifiers for categorical features into a strong classifier, the relations between these two different types of features are handled naturally, without any forced conversions between continuous and categorical features. Adaptable initial weights and a simple strategy for avoiding overfitting are adopted to improve the performance of the algorithm. Experimental results show that our algorithm has low computational complexity and error rates, as compared with algorithms of higher computational complexity, as tested on the benchmark sample data.Index Terms-AdaBoost, computational complexity, detection rate, false-alarm rate, intrusion detection.

show abstract

“…Caberera et al [2] adopt the Kolmogorov-Smirnov test to compare observation network signals with normal behavior signals, assuming that the number of observed events in a time segment obeys the Poisson distribution. Li and Manikopoulos [22] extract several representative parameters of network flows, and model these parameters using a hyperbolic distribution. Peng et al [23] use a nonparametric cumulative sum algorithm to analyze the statistics of network data, and further detect anomalies on the network.…”

Section: Introductionmentioning

confidence: 99%

Online Adaboost-Based Parameterized Methods for Dynamic Distributed Network Intrusion Detection

Gao

Wang

et al. 2014

IEEE Trans. Cybern.

142

View full text Add to dashboard Cite

Current network intrusion detection systems (NIDS) lack the adaptability to the frequently changing network environments. Furthermore, intrusion detection in the new distributed architectures is now a major requirement. In this paper, we propose two online Adaboost-based intrusion detection algorithms. In the first algorithm, a traditional online Adaboost process is used where decision stumps are used as weak classifiers. In the second algorithm, an improved online Adaboost process is proposed, and online GMMs are used as weak classifiers. We further propose a distributed intrusion detection framework, in which a local parameterized detection model is constructed in each node using the online Adaboost algorithm. A global detection model is constructed in each node by combining the local parametric models using a small number of samples in the node. This combination is achieved using an algorithm based on particle swarm optimization (PSO) and support vector machines (SVM). The global model in each node is used to detect intrusions. Experimental results show that the improved online Adaboost process with GMMs obtains a higher detection rate and a lower false alarm rate than the traditional online Adaboost process which uses decision stumps. Both the algorithms outperform existing intrusion detection algorithms. It is also shown that our PSO and SVM-based algorithm effectively combines the local detection models into the global model in each node: the global model in a node can handle the intrusion types which are found in other nodes, without sharing the samples of these intrusion types.

show abstract

Novel statistical network model: the hyperbolic distribution

Cited by 7 publications

References 4 publications

An effective intrusion detection method using optimal hybrid model of classifiers

An effective intrusion detection method using optimal hybrid model of classifiers

AdaBoost-Based Algorithm for Network Intrusion Detection

Online Adaboost-Based Parameterized Methods for Dynamic Distributed Network Intrusion Detection

Contact Info

Product

Resources

About