A new intrusion detection system using support vector machines and hierarchical clustering |
| |
Authors: | Latifur Khan Mamoun Awad Bhavani Thuraisingham |
| |
Affiliation: | (1) University of Texas at Dallas, Dallas, TX, USA |
| |
Abstract: | Whenever an intrusion occurs, the security and value of a computer system is compromised. Network-based attacks make it difficult
for legitimate users to access various network services by purposely occupying or sabotaging network resources and services.
This can be done by sending large amounts of network traffic, exploiting well-known faults in networking services, and by
overloading network hosts. Intrusion Detection attempts to detect computer attacks by examining various data records observed
in processes on the network and it is split into two groups, anomaly detection systems and misuse detection systems. Anomaly
detection is an attempt to search for malicious behavior that deviates from established normal patterns. Misuse detection
is used to identify intrusions that match known attack scenarios. Our interest here is in anomaly detection and our proposed
method is a scalable solution for detecting network-based anomalies. We use Support Vector Machines (SVM) for classification.
The SVM is one of the most successful classification algorithms in the data mining area, but its long training time limits
its use. This paper presents a study for enhancing the training time of SVM, specifically when dealing with large data sets,
using hierarchical clustering analysis. We use the Dynamically Growing Self-Organizing Tree (DGSOT) algorithm for clustering
because it has proved to overcome the drawbacks of traditional hierarchical clustering algorithms (e.g., hierarchical agglomerative
clustering). Clustering analysis helps find the boundary points, which are the most qualified data points to train SVM, between
two classes. We present a new approach of combination of SVM and DGSOT, which starts with an initial training set and expands
it gradually using the clustering structure produced by the DGSOT algorithm. We compare our approach with the Rocchio Bundling
technique and random selection in terms of accuracy loss and training time gain using a single benchmark real data set. We
show that our proposed variations contribute significantly in improving the training process of SVM with high generalization
accuracy and outperform the Rocchio Bundling technique. |
| |
Keywords: | |
本文献已被 SpringerLink 等数据库收录! |
|