Source-linked AI summary
Using Rough Set and Support Vector Machine for Network Intrusion Detection
Rung-Ching Chen, Kai-Fan Cheng, Chia-Fen Hsieh
TL;DR
The paper addresses inefficient intrusion monitoring amid large alert and packet volumes. It combines Rough Set Theory for feature reduction with an SVM classifier, and reports improved accuracy for the resulting RST-SVM framework.
Problem
IDS must distinguish attacks from normal behavior while handling large packet volumes and false positives that can burden analysis.
Method
The method preprocesses intrusion data, reduces features with Rough Set Theory, and classifies the selected features using SVM.
Results
RST-SVM reduces the feature count from 41 to 29 and achieves higher accuracy than full-feature and Entropy-based SVM approaches.
Takeaways & Limitations
The experiments support RST-SVM as an intrusion-detection framework that improves accuracy while reducing the number of input features.
Abstract
from arXiv · showhide
The main function of IDS (Intrusion Detection System) is to protect the system, analyze and predict the behaviors of users. Then these behaviors will be considered an attack or a normal behavior. Though IDS has been developed for many years, the large number of return alert messages makes managers maintain system inefficiently. In this paper, we use RST (Rough Set Theory) and SVM (Support Vector Machine) to detect intrusions. First, RST is used to preprocess the data and reduce the dimensions. Next, the features were selected by RST will be sent to SVM model to learn and test respectively. The method is effective to decrease the space density of data. The experiments will compare the results with different methods and show RST and SVM schema could improve the false positive rate and accuracy.
1. INTRODUCTION
The paper motivates IDS as a second line of network defense that distinguishes attacks from normal behavior. It proposes Rough Set Theory to reduce features before intrusion classification, aiming to improve detection performance and reduce analysis noise.
- Intrusion behaviors can seriously damage systems, motivating enterprises to deploy IDS alongside traditional defenses.
- IDS collects and analyzes network packets, monitors activities, and reports whether behavior is an attack or normal.
- Anomaly detection can identify new attacks but has a higher false positive rate, while large packet volumes can overload computation.
- The proposed method uses Rough Set Theory to reduce packet features, lowering noise that can affect system analysis performance.
- The paper reports that primary experiments improved the attack detection rate.
2. RELATED WORKS
The related work describes attack types and IDS detection paradigms. It distinguishes misuse detection based on known patterns from anomaly detection based on normal behavior profiles.
- The type intrusion methods: DoS and DDoS attacks overload hosts through large numbers of computers, login attempts, or transferred packets, consuming system and network resources.
- The type intrusion methods: R2L attacks target system intrusion, U2R attacks exploit unauthorized accounts, and port scans probe protocols and software weaknesses.
- Intrusion detection system: IDS includes misuse detection and anomaly detection as two principal approaches.
- Intrusion detection system: The application flow chart contrasts misuse detection based on an attack-attribute database with anomaly detection based on defined normal behavior.
A. Misuse Detection
Misuse detection identifies intrusions by comparing observed behavior with stored patterns of known attacks. Its operation is analogous to antivirus matching against known virus code.
- Misuse detection builds attack behavior patterns from known attacks during system development.
- It compares observed behavior with an attribute database and can defend against matching intrusions before system damage occurs.
- The paper compares misuse detection with antivirus software that matches scanned data against known virus code.
B. Anomaly Detection
Anomaly detection models normal user behavior and flags deviations, but the paper identifies limitations in recognizing changing attacks and in handling attacks that imitate normal behavior.
- Anomaly detection constructs a model of normal user behavior and notifies users when behavior deviates from it.
- Its detection depends on current attack models, so it cannot identify new attack behaviors when intruder methods change.
- An intruder can use normal behaviors to attack the system, limiting anomaly detection based on clearly defined legitimate behavior.
- IDS monitors network packet transmissions and alerts managers when malicious behavior occurs; systems are generally classified as NIDS or HIDS.
3. THE METHODOLOGY
The methodology preprocesses KDD Cup 1999 data, selects useful features with Rough Set Theory, and classifies intrusion versus normal behavior using SVM. RST reduces attributes before SVM training and testing, while SVM uses hyperplanes and kernel functions for binary classification.
- Method workflow: The workflow preprocesses and discretizes data, selects useful features with RST, then classifies the data using SVM.These are the three stated stages of the intrusion detection method.
- Pre-processing: KDD Cup 1999 data are filtered and converted into numerical form, with each process represented by 41 attributes.The dataset originates from the 1998 DARPA Intrusion Detection Evaluation.
- Feature selection by rough set: RST uses upper and lower approximations to analyze feature relations and select a reduced set of attributes for SVM models.The information-system representation defines a universe of process records and their attributes; approximations distinguish certain and possible set members.
- Feature selection by rough set: Reducing and combining similar attributes is intended to improve processing speed and intrusion detection performance compared with using all attributes.The paper states that using all attributes is ineffective and that reduced features can lower data noise affecting analysis.
- Intrusion estimation: SVM learns a binary classifier from training samples and support vectors by finding a hyperplane that separates the two categories.Kernel functions are used for problems in which the data are not linearly separable.
4. EXPERIMENTS AND DISCUSSIONS
The experiments evaluate wired-network IDS models using different feature sets and SVM classification. RST reduces features before SVM evaluation, and the proposed method is compared with full-feature and entropy-based alternatives.
- Experimental setup: The evaluation uses DARPA intrusion-detection data with seven weeks of training data and two weeks of testing data.The dataset contains labeled sessions and 24,701 training processes were used.
- Experimental setup: RST preprocessing formats the data, analyzes feature relations through upper and lower approximations, and selects reduced features for SVM training.The experiments use all 41 features, entropy features, and 29 RST feature values across three SVM models.
- Classification and metrics: The SVM outputs 1 for intrusion behaviour and -1 for normal behaviour during classification.The system uses LibSVM to train and test the models.
- Classification and metrics: The experiments measure attack detection rate, false positive rate, accuracy, precision, recall, overall accuracy, and false alarm rate.The formulas are used to estimate wired-network IDS performance.
- Results: 86.79% accuracy and 70.03% ADR are obtained with all 41 features, while entropy-SVM reaches 92.44% ADR and 73.83% accuracy.The reported comparisons show different trade-offs among feature-selection strategies.
- Results: The RST-SVM method achieves the best accuracy, although its false positive rate and attack detection rate are worse than entropy-SVM.The comparison is reported in Table 6.
5. CONCLUSIONS AND FUTURE WORKS
The paper proposes RST-SVM to reduce intrusion-detection features from 41 to 29 and reports higher accuracy than full-feature and entropy-based SVM models. Future work will use more testing data and combine RST with a genetic algorithm.
- Conclusions: RST-SVM reduces the number of intrusion-detection features from 41 to 29 before SVM classification.The method is compared with full-feature and entropy-based approaches.
- Conclusions: The RST-SVM framework yields higher accuracy than both the full-feature and entropy-based SVM methods.The experiment is reported as demonstrating better accuracy for RST-SVM.
- Future works: Future work will increase the number of testing data to examine variation in accuracy.The authors also propose combining RST with a genetic algorithm to improve IDS accuracy.
Authors
The authors are affiliated with Chaoyang University of Technology and work across information management, computer science, and informatics. Their stated interests include network and intrusion-detection security.
- Author affiliations: Rung-Ching Chen is a professor and Dean of the College of Informatics at Chaoyang University of Technology.His degrees include electrical engineering, computer engineering, and applied mathematics in computer science.
- Author affiliations: Kai-Fan Cheng is a graduate student in Information Management at Chaoyang University of Technology.His research interests include intrusion detection in ad hoc and wired networks.
- Author affiliations: Chia-Fen Hsieh is a doctoral candidate in informatics at Chaoyang University of Technology.His interests include intrusion detection in wireless sensor, ad hoc, and wired networks.