As a primary defense technique, intrusion detection becomes more and more significant since the security of the networks is one of the most critical issues in the world. We present an adaptive collaboration intrusion ...As a primary defense technique, intrusion detection becomes more and more significant since the security of the networks is one of the most critical issues in the world. We present an adaptive collaboration intrusion detection method to improve the safety of a network. A self-adaptive and collaborative intrusion detection model is built by applying the Environmentsclasses, agents, roles, groups, and objects(E-CARGO) model. The objects, roles, agents, and groups are designed by using decision trees(DTs) and support vector machines(SVMs), and adaptive scheduling mechanisms are set up. The KDD CUP 1999 data set is used to verify the effectiveness of the method. The experimental results demonstrate the feasibility and efficiency of the proposed collaborative and adaptive intrusion detection method. Also, the proposed method is shown to be more predominant than the methods that use a set of single type support vector machine(SVM) in terms of detection precision rate and recall rate.展开更多
Intrusion detection can be essentially regarded as a classification problem,namely,dis-tinguishing normal profiles from intrusive behaviors. This paper introduces boosting classification algorithm into the area of int...Intrusion detection can be essentially regarded as a classification problem,namely,dis-tinguishing normal profiles from intrusive behaviors. This paper introduces boosting classification algorithm into the area of intrusion detection to learn attack signatures. Decision tree algorithm is used as simple base learner of boosting algorithm. Furthermore,this paper employs the Principle Com-ponent Analysis (PCA) approach,an effective data reduction approach,to extract the key attribute set from the original high-dimensional network traffic data. KDD CUP 99 data set is used in these ex-periments to demonstrate that boosting algorithm can greatly improve the classification accuracy of weak learners by combining a number of simple “weak learners”. In our experiments,the error rate of training phase of boosting algorithm is reduced from 30.2% to 8% after 10 iterations. Besides,this paper also compares boosting algorithm with Support Vector Machine (SVM) algorithm and shows that the classification accuracy of boosting algorithm is little better than SVM algorithm’s. However,the generalization ability of SVM algorithm is better than boosting algorithm.展开更多
基金supported in part by the National Natural Science Foundation of China(61772141,61673123)Guangdong Provincial Science&Technology Project(2015B090901016,2016B010108007)+1 种基金Guangdong Education Department Project(Guangdong Higher Education letter 2015[133])the Guangzhou Science&Technology Project(201508010067,201604020145201604046017,and 2016201604030034)
文摘As a primary defense technique, intrusion detection becomes more and more significant since the security of the networks is one of the most critical issues in the world. We present an adaptive collaboration intrusion detection method to improve the safety of a network. A self-adaptive and collaborative intrusion detection model is built by applying the Environmentsclasses, agents, roles, groups, and objects(E-CARGO) model. The objects, roles, agents, and groups are designed by using decision trees(DTs) and support vector machines(SVMs), and adaptive scheduling mechanisms are set up. The KDD CUP 1999 data set is used to verify the effectiveness of the method. The experimental results demonstrate the feasibility and efficiency of the proposed collaborative and adaptive intrusion detection method. Also, the proposed method is shown to be more predominant than the methods that use a set of single type support vector machine(SVM) in terms of detection precision rate and recall rate.
基金National High-tech R&D Program of China (2003AA142060)National Basic Research Program of China (2001CB09403).
文摘Intrusion detection can be essentially regarded as a classification problem,namely,dis-tinguishing normal profiles from intrusive behaviors. This paper introduces boosting classification algorithm into the area of intrusion detection to learn attack signatures. Decision tree algorithm is used as simple base learner of boosting algorithm. Furthermore,this paper employs the Principle Com-ponent Analysis (PCA) approach,an effective data reduction approach,to extract the key attribute set from the original high-dimensional network traffic data. KDD CUP 99 data set is used in these ex-periments to demonstrate that boosting algorithm can greatly improve the classification accuracy of weak learners by combining a number of simple “weak learners”. In our experiments,the error rate of training phase of boosting algorithm is reduced from 30.2% to 8% after 10 iterations. Besides,this paper also compares boosting algorithm with Support Vector Machine (SVM) algorithm and shows that the classification accuracy of boosting algorithm is little better than SVM algorithm’s. However,the generalization ability of SVM algorithm is better than boosting algorithm.
