A novel intrusion detection system based on hierarchical clustering and support vector machines

This study proposed an SVM-based intrusion detection system, which combines a hierarchical clustering algorithm, a simple feature selection procedure, and the SVM technique. The hierarchical clustering algorithm provided the SVM with fewer, abstracted, and higher-qualified training instances that ar...

Ausführliche Beschreibung

Gespeichert in:
Bibliographische Detailangaben
Veröffentlicht in:Expert systems with applications Jg. 38; H. 1; S. 306 - 313
Hauptverfasser: Horng, Shi-Jinn, Su, Ming-Yang, Chen, Yuan-Hsin, Kao, Tzong-Wann, Chen, Rong-Jian, Lai, Jui-Lin, Perkasa, Citra Dwi
Format: Journal Article
Sprache:Englisch
Veröffentlicht: Elsevier Ltd 01.01.2011
Schlagworte:
Algorithms
Classification
Clustering
Data mining
Expert systems
Hierarchical clustering algorithm
Intrusion
KDD Cup 1999
Network intrusion detection system (NIDS)
Network security
Resultants
Support vector machines
Support vector machines (SVMs)
Training
Network security
Support vector machines (SVMs)
Network intrusion detection system (NIDS)
KDD Cup 1999
Data mining
Hierarchical clustering algorithm
ISSN:0957-4174, 1873-6793
Online-Zugang:Volltext
Tags: Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
Beschreibung
Zusammenfassung:This study proposed an SVM-based intrusion detection system, which combines a hierarchical clustering algorithm, a simple feature selection procedure, and the SVM technique. The hierarchical clustering algorithm provided the SVM with fewer, abstracted, and higher-qualified training instances that are derived from the KDD Cup 1999 training set. It was able to greatly shorten the training time, but also improve the performance of resultant SVM. The simple feature selection procedure was applied to eliminate unimportant features from the training set so the obtained SVM model could classify the network traffic data more accurately. The famous KDD Cup 1999 dataset was used to evaluate the proposed system. Compared with other intrusion detection systems that are based on the same dataset, this system showed better performance in the detection of DoS and Probe attacks, and the beset performance in overall accuracy.
Bibliographie:ObjectType-Article-1
SourceType-Scholarly Journals-1
ObjectType-Feature-2
content type line 23
ISSN:0957-4174
1873-6793
DOI:10.1016/j.eswa.2010.06.066