In the new distributed architecture, intrusion detection is one of the main requirements. In our research, two adaboost algorithms have been proposed. The very first procedure is a traditional online adaboost algorith...
详细信息
ISBN:
(纸本)9781538605691
In the new distributed architecture, intrusion detection is one of the main requirements. In our research, two adaboost algorithms have been proposed. The very first procedure is a traditional online adaboost algorithm, where we make use of decision stumps. Decision stumps will be regarded as weak classifiers. In the following second procedure we make use of an enhanced online adaboost algorithm with online Gaussian Mixture Model (GMM) which will be referred as weak classifiers. Additionally we will be having distributed incursion detection framework, where local parameterized models for incursion detection are formed in every node by Adaboost procedures. Global detection models are also built up at every node by the combination of local parametric models by means of minor quantity of examples in the node. This arrangement is attained by a procedure constructed on the Particle Swarm Optimization (PSO) and also Support Vector Machines(SVM). Incursions will be detected using Global model in every node. Data collected on experimental results shows enhanced online adaboost process with GMM gives improved and high detection rate and reduced false alarms than the previous Adaboost processes. Our two algorithms outperform the current incursion detection procedures. It can be seen that our SVM and PSO based algorithms efficiently combines local models into global models at every node. The Global models in the node can identify and alarm incursions types which can be found in different nodes without sharing of samples of those incursion types.
Current network intrusion detection systems lack adaptability to the frequently changing network environments. Furthermore, intrusion detection in the new distributed architectures is now a major requirement. In this ...
详细信息
Current network intrusion detection systems lack adaptability to the frequently changing network environments. Furthermore, intrusion detection in the new distributed architectures is now a major requirement. In this paper, we propose two online Adaboost-based intrusion detection algorithms. In the first algorithm, a traditional online Adaboost process is used where decision stumps are used as weak classifiers. In the second algorithm, an improved online Adaboost process is proposed, and online Gaussian mixture models (GMMs) are used as weak classifiers. We further propose a distributed intrusion detection framework, in which a local parameterized detection model is constructed in each node using the online Adaboost algorithm. A global detection model is constructed in each node by combining the local parametric models using a small number of samples in the node. This combination is achieved using an algorithm based on particle swarm optimization (PSO) and support vector machines. The global model in each node is used to detect intrusions. Experimental results show that the improved online Adaboost process with GMMs obtains a higher detection rate and a lower false alarm rate than the traditional online Adaboost process that uses decision stumps. Both the algorithms outperform existing intrusion detection algorithms. It is also shown that our PSO, and SVM-based algorithm effectively combines the local detection models into the global model in each node;the global model in a node can handle the intrusion types that are found in other nodes, without sharing the samples of these intrusion types.
暂无评论