No Access

Intelligent Intrusion Detection System Through Combined and Optimized Machine Learning

Syed Ali Raza Shah

School of Computing, Media and the Arts, Teesside University, Middlesbrough, England, UK

E-mail Address: ali.aliraza@gmail.com

Search for more papers by this author

Biju Issac

School of Computing, Media and the Arts, Teesside University, Middlesbrough, England, UK

E-mail Address: bissac@ieee.org

Corresponding author.

Search for more papers by this author

, and

Seibu Mary Jacob

School of Engineering, Science and Design, Teesside University, Middlesbrough, England, UK

E-mail Address: s.jacob@tees.ac.uk

Search for more papers by this author

https://doi.org/10.1142/S1469026818500074Cited by:4 (Source: Crossref)

Abstract

In this paper, an existing rule-based intrusion detection system (IDS) is made more intelligent through the application of machine learning. Snort was chosen as it is an open source software and though it was performing well, it showed false positives (FPs). To find the best performing machine learning algorithms (MLAs) to use with Snort so as to improve its detection, we tested some algorithms on three available datasets. Support vector machine (SVM) was chosen along with fuzzy logic and decision tree based on their accuracy. Combined versions of algorithms through ensemble SVM along with other variants were tried on the generated traffic of normal and malicious packets at 10Gbps. Optimized versions of the SVM along with firefly and ant colony optimization (ACO) were also tried, and the accuracy improved remarkably. Thus, the application of combined and optimized MLAs to Snort at 10Gbps worked quite well.

Keywords:

Remember to check out the Most Cited Articles!
Check out these titles in artificial intelligence!

References

1. A. Sharma, A. Zaidi, R. Singh, S. Jain and A. Sahoo, Optimization of SVM classifier using Firefly algorithm, 2013 IEEE Second Int. Conf. Image Information Processing, 2013, Shimla, pp. 198–202. Google Scholar
2. C. Cortes and V. Vapnik, Support-vector networks, Mach. Learn. 20 (3) (1995) 273–297. Crossref, Google Scholar
3. C. Kolias, G. Kambourakis, A. Stavrou and S. Gritzalis, Intrusion detection in 802.11 networks: Empirical evaluation of threats and a public dataset, IEEE Commun. Surv. Tutor. 18 (1) (2016) 184–208. Crossref, Google Scholar
4. C. Yin, Y. Zhu, J. Fei and X. He, A deep learning approach for intrusion detection using recurrent neural networks, IEEE Access 5 (2017) 21954–21961. Crossref, Google Scholar
5. D. Kim and C. Kim, Forecasting time series with genetic fuzzy predictor ensemble, IEEE Trans. Fuzzy Syst. 5 (4) (1997) 523–535. Crossref, Google Scholar
6. DARPA IDS, DARPA intrusion detection data sets, http://www.ll.mit.edu/ideval/data/. Google Scholar
7. E. M. Kakihata et al., Intrusion detection system based on flows using machine learning algorithms, IEEE Latin Am. Trans. 15 (10) (2017) 1988–1993. Crossref, Google Scholar
8. E. Tuba, L. Mrkela and M. Tuba, Support vector machine parameter tuning using firefly algorithm, 2016 26th Int. Conf. Radioelektronika, 2016, Kosice, pp. 413–418. Google Scholar
9. F. K. Hussain, E. Chang and O. K. Hussain, State of the art review of the existing bayesian-network based approaches to trust and reputation computation, Second Int. Conf. Internet Monitoring and Protection (ICIMP 2007), 2007, San Jose, CA, pp. 26–26. Google Scholar
10. H. Kim, S. Pang, H. Je, D. Kim and S. Y. Bang, Constructing support vector machine ensemble, Pattern Recognit. 36 (12) (2003) 2757–2767. Crossref, Google Scholar
11. H. Liao, C. Alberti, M. Bacchiani and O. Siohan, Interspeech, ISCA 2010, (2010) 2958–2961. Google Scholar
12. H. Zhang and J. Su, Naive Bayes for optimal ranking, J. Exp. Theor. Artif. Intell. 20 (2) (2008) 79–93. Crossref, Google Scholar
13. J. Acevedo, S. Maldonado, S. Lafuente, H. Gomez and P. Gil, Model selection for support vector machines using ant colony optimization in an electronic nose application, Ant Colony Optimization and Swarm Intelligence: 5th International Workshop, ANTS 2006, eds. M. Dorigo, L. M. Gambardella, M. Birattari, A. Martinoli, R. Poli and T. Stützle, Lecture Notes in Computer Science, Vol. 4150 (Springer, Berlin, Heidelberg, 2006). Google Scholar
14. J. Stork, R. Ramos, P. Koch and W. Konen, SVM ensembles are better when different kernel types are combined, Data Science, Learning by Latent Structures, and Knowledge Discovery. Studies in Classification, Data Analysis, and Knowledge Organization, eds. B. Lausen, S. Krolak-Schwerdt and M. Bohmer, (Springer, Berlin, Heidelberg, 2015). Crossref, Google Scholar
15. M. A. Kumar and M. Gopal, A hybrid SVM based decision tree, Pattern Recognit. 43 (12) (2010) 3977–3987. Crossref, Google Scholar
16. M. Agarwal and A. Singh, Metasploit Penetration Testing Cookbook, 2nd edn. (Packt Publishing, Birmingham, UK, 2013). Google Scholar
17. M. Deraman, A. Desa and Z. A. Othman, Public domain datasets for optimizing network intrusion and machine learning approaches, 2011 3rd Conf. Data Mining and Optimization (DMO), Kuala Lumpur, 2011, pp. 51–56. Google Scholar
18. N. Heikura, Analyzing offensive and defensive networking tools in a laboratory environment, Master of Science thesis, Tampere University of Technology, Finland, (2015). Google Scholar
19. NSL-KDD, The NSL-KDD Dataset, 2014, http://nsl.cs.unb.ca/NSL-KDD/. Google Scholar
20. O. Y. Al-Jarrah, O. Alhussein, P. D. Yoo, S. Muhaidat, K. Taha and K. Kim, Data randomization and cluster-based partitioning for botnet intrusion detection, in IEEE Trans. Cybern. 46 (8) (2016) 1796–1806. Crossref, Google Scholar
21. R. Karthik, S. Veni and B. L. Shivakumar, Fuzzy based support vector machine classifier with weiner filter system (FSVM-WF) for intrusion detection, Int. J. Adv. Res. Comput. Sci. 7 (4) (2016) 11–15. Google Scholar
22. R. Lowen and M. R. Roubens, Fuzzy Logic: State of the Art (Springer, Netherlands, 1993). Crossref, Google Scholar
23. SIDL, Snort Intrusion Detection Log from 07-Nov-08 to 16-Nov-11 (Entire Exercise), http://www.usma.edu/crc/sitepages/datasets.aspx. Google Scholar
24. Snort. Available at: https://www.snort.org/(accessed: 10 September 2017). Google Scholar
25. T. Jinyu and Z. Xin, Project financing risk assessment based on ACO and SVM, 2009 ISECS Int. Colloquium Computing, Communication, Control, and Management, Sanya, 2009, pp. 300–302. Google Scholar
26. T. Zhang and Q. Zhu, Distributed privacy-preserving collaborative intrusion detection systems for VANETs, IEEE Trans. Signal Inf. Process. Netw. 4 (1) (2018) 148–161. Crossref, Google Scholar
27. W. Hu, W. Hu and S. Maybank, AdaBoost-based algorithm for network intrusion detection, IEEE Trans. Syst. Man Cybern. B Cybern. 38 (2) (2008) 577–583. Crossref, Google Scholar
28. Weka, Weka 3: Data Mining Software in Java (2017), https://www.cs.waikato.ac.nz/ml/weka/. Google Scholar
29. X. Wang, C. Zhang and K. Zheng, Intrusion detection algorithm based on density, cluster centers, and nearest neighbors, China Commun. 13 (7) (2016) 24–31. Crossref, Google Scholar
30. Y. Freund and R. Schapire, A decision theoretic generalization of online learning and an application to boosting, J. Comput. Syst. Sci. 55 (1) (1997) 119–139. Crossref, Google Scholar