A New Data-Mining Based Approach for Network Intrusion Detection
- 1 May 2009
- conference paper
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 372-377
- https://doi.org/10.1109/cnsr.2009.64
Abstract
Nowadays, as information systems are more open to the Internet, the importance of secure networks is tremendously increased. New intelligent intrusion detection systems (IDSs) which are based on sophisticated algorithms rather than current signature-base detections are in demand. In this paper, we propose a new data-mining based technique for intrusion detection using an ensemble of binary classifiers with feature selection and multiboosting simultaneously. Our model employs feature selection so that the binary classifier for each type of attack can be more accurate, which improves the detection of attacks that occur less frequently in the training data. Based on the accurate binary classifiers, our model applies a new ensemble approach which aggregates each binary classifierpsilas decisions for the same input and decides which class is most suitable for a given input. During this process, the potential bias of certain binary classifier could be alleviated by other binary classifierspsila decision. Our model also makes use of multiboosting for reducing both variance and bias. The experimental results show that our approach provides better performance in terms of accuracy and cost than the winner entry of the dasiaKnowledge Development and Data miningpsila (KDD) psila99 cup challenge. Future works will extend our analysis to a new dasiaProtected Repository for the Defense of Infrastructure against Cyber Threatspsila (PREDICT) dataset as well as real network data.Keywords
This publication has 9 references indexed in Scilit:
- Feature deduction and ensemble design of intrusion detection systemsComputers & Security, 2004
- A data mining framework for building intrusion detection modelsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- Information-theoretic measures for anomaly detectionPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- A Data Mining and CIDF Based Approach for Detecting Novel and Distributed IntrusionsLecture Notes in Computer Science, 2000
- Winning the KDD99 classification cupACM SIGKDD Explorations Newsletter, 2000
- MultiBoosting: A Technique for Combining Boosting and WaggingMachine Learning, 2000
- An Empirical Comparison of Voting Classification Algorithms: Bagging, Boosting, and VariantsMachine Learning, 1999
- A Decision-Theoretic Generalization of On-Line Learning and an Application to BoostingJournal of Computer and System Sciences, 1997
- Bagging predictorsMachine Learning, 1996