Similar articles

Abstract: Recently machine learning-based intrusion detection approaches have been subjected to extensive researches because they can detect both misuse and anomaly. In this paper, rough set classification (RSC), a modern learning algorithm, is used to rank the features extracted for detecting intrusions and generate intrusion detection models. Feature ranking is a very critical step when building the model. RSC performs feature ranking before generating rules, and converts the feature ranking to minimal hitting set problem addressed by using genetic algorithm (GA). This is done in classical approaches using support vector machine (SVM) by executing many iterations, each of which removes one useless feature. Compared with those methods, our method can avoid many iterations. In addition, a hybrid genetic algorithm is proposed to increase the convergence speed and decrease the training time of RSC. The models generated by RSC take the form of “IF-THEN” rules, which have the advantage of explication. Tests and comparison of RSC with SVM on DARPA benchmark data showed that for Probe and DoS attacks both RSC and SVM yielded highly accurate results (greater than 99% accuracy on testing set).

[1] Aleksander, Ø., 1999. Discernibility and Rough Sets in Medicine: Tools and Applications. PhD Dissertation, http://www.idi.ntnu.no/~aleks/thesis.

[2] Allen, J., Christie, A., Fithen, W., McHugh, J., Pickel, J., Stoner, E., 2000. State of the Practice of Intrusion Detection. Technical Report, http://www.sei.cmu.edu/pub/.

[3] Anders, T.B., 1997. Rough Enough(A System Supporting the Rough Sets Approach. Sixth Scandinavian Conference on Artificial Intelligence SCAI’97.

[4] Bazan, J.G., Skowron, A., Synak, P., 1994. Dynamic Reducts as A Tool for Extracting Laws from Decision Tables. Proceedings of ISMIS’94. Lecture Notes in Artificial Intelligence 869. Springer-Verlag, Berlin, p.346-355.

[5] Chang, C., Lin, J., 2003. LIBSVM, A Library for Support Vector Machines. http://www.csie.ntu.edu.tw/~cjlin/libsvm/.

[6] Goldberg, D.E., 1989. Genetic Algorithms in Search, Optimization, and Machine Learning. Addison-Wesley, Reading, M.A.

[7] James, C., 1998. The Application of Artificial Neural Networks to Misuse Detection: Initial Results. RAID98, Louvain-la-Neuve, Belgium, p.14-16.

[8] KDD, 1999. http://kdd.ics.uci.edu/databases/kddcup99/task.html.

[9] Pawlak, Z., 1982. Rough sets. International Journal of Computer and Information Sciences, 11:341-356.

[10] Srinivas, M., Sung, A., 2002. Feature Ranking and Selection for Intrusion Detection. Proceedings of the International Conference on Information and Knowledge Engineering.

[11] Wang, G.Y., eds, 2001. Rough Set Theory and Knowledge Acquistion. Xi’an Jiaotong University Press, Xi’an (in Chinese).

[12] Wang, J., Tao, Q., 2003. Rough Set Theory and Statistical learning Theory. In: Lu, R.Z., ed., Knowledge Science and Computing Science. Tsinghua University Press, Beijing, p.49 (in Chinese).

[13] Wenke, L., 1999. A Data Mining Framework for Constructing Features and Models for Intrusion Detection Systems. PhD dissertation, http://www.cc.gatech.edu/~wenke/.

[14] Wroblewski, J., 1995. Finding Minimal Reducts Using Genetic Algorithms. Proc. of the second Annual Join Conference on Information Sciences. Wrightsvillle Beachm, NC, p.186-189.