適用於網路入侵偵測不平衡資料之階層式多重分類器

網路活動在近幾年行動裝置普及和雲端化趨勢的推動下有顯著成長，因此入侵偵測系統的存在是非常重要的。由於實際網路流量中相對於正常連接，攻擊的存在是少量的，因此許多基於統計模型的監督式入侵偵測系統不易偵測與分類這些少量但有害的攻擊。本研究中，提出一個基於多個分類器的結合並透過階層式分類平衡數據量的入侵偵測系統，依資料中各類的錯誤成本敏感程度與類包含資料的數目作為分割依據，利用多個二元分類器與一個多類分類器將資料中的每一類依序找出。此方法優點在於富彈性適合各種流行的分類演算法，同時不需修改原始訓練資料統計分布，可以降低入侵偵測中因為原始訓練資料集的各類資料數量相差過大造成的分類誤差，對錯誤成本較敏感的網路入侵資料平均成本也有降低。實驗與結果評估採用KDD CUP 99 資料集入侵偵測資料集以及其修改後之ND-KDD資料集測試，在ND-KDD資料集實驗，四種演算法使用階層式多重分類器的錯誤率平均降低百分之十六，平均成本降低百分之十三。

關鍵字

入侵偵測系統；不平衡資料集；階層式分類器

並列摘要

Recently, under the popularity of mobile device and the driving of cloud computing, the network activities has grown remarkably. Thus, the Intrusion Detection Systems become very important. Compare to the regular connection, the attacks are relatively lesser in actual Internet traffic. Therefore, lots of supervisor’s intrusion detection systems, which are designed by the basis of statistical model are not easy to detect and classify those few but harmful attacking. In the paper, we propose an Intrusion Detection System which is based on the multi-classifier that can balance the numbers of data through hierarchical classifications. The different sensitivity of all various error cost and the numbers of data included in class are the basis of dividing. We take multi binary-classifier and single multiclass classifier to find every class from data in order. The benefit of the way is rich of flexibility and suitable for all kinds of popular classifcation algorithms. During intrusion detecting, it can less the classify errors which were caused by the variances in the numbers of all types of original training data set without modifying the distribution of original training data. It also less the average cost for intrusion detection data which are sensitive to error cost. The assessment of experimental method and result will be testified adopting KDD CUP 99 and the modified ND-KDD. In the ND-KDD, the four kinds of algorithms, which are hierarchical multi classifications can less 16% error rates and 13% average costs.

並列關鍵字

Intrusion detection systems ； imbalanced dataset ； hierarchical classifier

參考文獻

[2] N. B. AMOR, S. BENFERHAT, and Z. ELOUEDI. "Naive bayes vs decision trees in intrusion detection systems". in Proceedings of the 2004 ACM symposium on Applied computing. 2004. ACM.

[4] V. BOLON-CANEDO, N. SANCHEZ-MARONO, and A. ALONSO-BETANZOS, "Feature selection and classification in multiple class datasets: An application to KDD Cup 99 dataset". Expert Systems with Applications, 2011. 38(5): p. 5947-5957.

[5] V. BOLON-CANEDO, N. SANCHEZ-MAROO, and A. ALONSO-BETANZOS. "A combination of discretization and filter methods for improving classification performance in KDD Cup 99 dataset". in Neural Networks, 2009. IJCNN 2009. International Joint Conference on. 2009. IEEE.

[6] BRO. 2014; Available from: https://www.bro.org/index.html.

[7] V. CHANDOLA, A. BANERJEE, and V. KUMAR, "Anomaly detection: A survey". ACM Computing Surveys (CSUR), 2009. 41(3): p. 15.

國際替代計量

適用於網路入侵偵測不平衡資料之階層式多重分類器

全文下載

主題瀏覽