Integrating the SVM-based intrusion detection system into the Hadoop

Integrating the SVM-based intrusion detection system into the Hadoop

黃昱翔(Yu-Shiang Huang)

指導教授 ： 莊詠婷 ； 古政元

國立中正大學/管理學院/資訊管理學系/碩士(2015年)

並列摘要

The 21st century is the information age. Because of the network infrastructure and technology has great development, network traffic increases very fast. For the network security, the network service provider should monitor traffic in a large scale network. They are challenged by handling a huge amount of traffic data for processing and management. The traditional intrusion detection systems (IDSs) are not enough to handle such Big Data efficiently. A flexible, effective network IDS is necessary to meet this case. In recent years, as the development of cloud computing technique, the cloud platform Hadoop which is the critical big data solution can provide an opportunity to process massive data. Mapreduce framework of Hadoop provides programmers the ability to produce parallel distributed programs more easily. Therefore, it is rational to apply this parallel computing architecture for the large traffic data monitor and analysis application. We created an IDS system based on support vector machines (SVM), and integrated it into Hadoop. Our goal is to run the detection function in parallel so that we can accelerate the analysis process. We conducted a series of experiment for the system evaluation. According to the experiment result, the proposed system has an impressive performance in the big data traffic analysis environment.

並列關鍵字

Support vector machine ； Machine learning ； Network intrusion detection ； Cloud computing

參考文獻

Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., et al. (2010). A view of cloud computing. Communications of the ACM, 53(4), 50-58, doi:10.1145/1721654.1721672.

Lin, C. H., Liu, J. C., & Ho, C. H. (2008). Anomaly Detection Using LibSVM Training Tools. Proceedings of the 2008 International Conference on (2008), pp. 166-171, doi:10.1109/ISA.2008.12.

Denning, D. E. (1987). An Intrusion-Detection Model. IEEE Transactions on Software Engineering, v.13 n.2, p.222-232.

Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009). Anomaly-based network intrusion detection: Techniques, systems and challenges. Computers & security, 28(1), 18-28.

Hsu, C. W., Chang, C. C. & Lin, C. J. (2010). A Practical Guide to Support Vector Classification. Retrieved January 19, 2015, from http://www.csie.ntu.edu.tw/~cjlin/papers/guide/guide.pdf