Source-linked AI summary
Combining Naive Bayes and Decision Tree for Adaptive Intrusion Detection
Dewan Md. Farid, Nouria Harbi, Mohammad Zahidur Rahman
TL;DR
Current intrusion detection systems must handle large and complex data while limiting false positives and uneven detection across attack types. The paper combines naïve Bayes and ID3 in an adaptive hybrid algorithm, which achieved 99% accuracy on five KDD99 attack classes while minimizing false positives and balancing detection rates.
Problem
Current intrusion detection systems face low accuracy, uneven detection across attack types, high false positives, redundant training attributes, and large volumes of data requiring rapid processing.
Method
The paper develops a hybrid adaptive intrusion-detection algorithm combining a naïve Bayesian classifier with ID3, while selecting attributes and addressing continuous values, missing values, and training-data noise.
Results
99% accuracy was achieved for attacks in the five-class KDD99 benchmark, while the hybrid algorithm minimized false positives and maximized balanced detection rates.
Takeaways & Limitations
The proposed algorithm supports adaptive network intrusion detection with balanced detection and reduced false positives using limited computational resources.
Takeaways & Limitations
Perfect intrusion detection remains difficult because achieving a 100% detection rate with 0% false positives is hard in practice.
Abstract
from arXiv · showhide
In this paper, a new learning algorithm for adaptive network intrusion detection using naive Bayesian classifier and decision tree is presented, which performs balance detections and keeps false positives at acceptable level for different types of network attacks, and eliminates redundant attributes as well as contradictory examples from training data that make the detection model complex. The proposed algorithm also addresses some difficulties of data mining such as handling continuous attribute, dealing with missing attribute values, and reducing noise in training data. Due to the large volumes of security audit data as well as the complex and dynamic properties of intrusion behaviours, several data miningbased intrusion detection techniques have been applied to network-based traffic data and host-based data in the last decades. However, there remain various issues needed to be examined towards current intrusion detection systems (IDS). We tested the performance of our proposed algorithm with existing learning algorithms by employing on the KDD99 benchmark intrusion detection dataset. The experimental results prove that the proposed algorithm achieved high detection rates (DR) and significant reduce false positives (FP) for different types of network intrusions using limited computational resources.
1. INTRODUCTION
Intrusion detection research addresses large, complex, changing security data, but current systems can suffer uneven attack detection, false positives, redundant inputs, and computational demands.
- Anomaly detection can identify new attacks but produces many false positives, motivating adaptive intrusion detection for audit-data analysis and rule optimization.
- Intrusion detection research applies decision trees, naïve Bayes, neural networks, support vector machines, nearest neighbors, fuzzy logic, and genetic algorithms.
- Current IDS problems include low detection accuracy, unbalanced detection rates across attack types, high false positives, and redundant training attributes and examples.
- High-speed networks require IDS to process large volumes of network data within very short times for real-time intrusion detection.
- The paper proposes and experimentally evaluates an adaptive learning algorithm, with the paper organized around background, learning problems, the algorithm, experiments, and conclusions.
2. NETWORKING AND INTRUSION DETECTION OVERVIEW
The overview describes network communication and intrusion-detection models, introduces performance measures, and situates Bayesian intrusion detection within prior research.
- 2.1. Networking Overview: TCP/IP networking uses application, transport, network, and hardware layers that cooperate to transfer data between hosts.
- 2.2. Intrusion Detection Overview: Misuse-based IDS detect known attack patterns, whereas anomaly-based IDS identify deviations from normal behavior but produce many false positives.
- 2.2. Intrusion Detection Overview: Network-based IDS monitor and analyze network traffic using multiple sensors to detect intrusions from internal and external networks.
- 2.2. Intrusion Detection Overview: IDS performance is commonly assessed using detection rate and false positive measures, with precision, recall, overall performance, and false alarm also used.
- 2.3. Related Work: Prior work progressed from anomaly-based monitoring to statistical, immune-inspired, and Bayesian approaches for intrusion detection and false-alarm suppression.
3. BASIC PROBLEMS OF LEARNING
The learning discussion focuses on noise, missing and contradictory data, continuous attributes, and input selection because these factors affect model complexity, accuracy, and training speed.
- 3.1. Noise in Dataset: Noise handling aims to prevent overfitting because learning performance depends on dataset quality.
- 3.1. Noise in Dataset: Missing attribute values can be replaced by the most frequent value or represented using calculated probabilities.
- 3.1. Noise in Dataset: Contradictory examples with different labels confuse learning algorithms and should be avoided or correctly labeled before training.
- 3.1. Noise in Dataset: Redundant examples can alter ID3 decision trees, while removing duplicate copies saves storage and speeds learning.
- 3.2. Dealing with Continuous Attribute: Continuous attributes are discretized into intervals, with candidate borders placed between adjacent values from different classes and selected using information gain.
- 3.3. Input Attribute Selection from Dataset: Input attribute selection removes irrelevant or redundant features that can increase model complexity, reduce accuracy, and raise computational time.
4. PROPOSED HYBRID ALGORITHM
The proposed Adaptive Intrusion Detection Model combines naïve Bayes classification with decision-tree splitting, iteratively refining probabilities and attributes until training examples are correctly classified.
- Model output: The resulting model is identified as the Adaptive Intrusion Detection Model, or AIDM.The procedure outputs an adaptive intrusion detection model after probability estimation and recursive splitting.
- Data preparation: The algorithm removes duplicate training examples before learning and examines continuous attributes for class-separating interval boundaries.It retains one unique copy of repeated examples and searches adjacent continuous values assigned to different classes.
- Naïve Bayes classification: It calculates prior and conditional probabilities, classifies examples using posterior likelihoods, and updates class values by maximum likelihood.Each example is assigned the class with the highest posterior probability before probabilities are recalculated.
- Decision-tree refinement: When examples remain misclassified, the algorithm computes information gain, selects the best attribute, and splits the dataset into attribute-based sub-datasets.The same process is applied recursively to misclassified sub-datasets.
- Model output: The refinement continues until all examples are correctly classified, while preserving probability values for future classification of unseen examples.Prior and conditional probabilities are retained for each resulting dataset.
5. EXPERIMENTAL ANALYSIS
The evaluation uses the KDD99 benchmark to compare the proposed algorithm with existing classifiers across five intrusion classes and different attribute sets, including reduced datasets.
- KDD Cup 1999 Dataset: The KDD99 dataset distinguishes normal connections from DoS, R2L, U2R, and probing attacks, with the four attack categories divided into 22 attacks.Normal traffic represents simulated daily user behavior, while the attack classes represent distinct intrusion types.
- KDD Cup 1999 Dataset: KDD99 provides 41 input attributes per network connection, covering basic, content, and statistical features.The attributes include connection properties, content information, and statistics computed over time windows or connections.
- Experimental Analysis: The experiments perform five-class classification on KDD99 and compare the proposed algorithm with ID3 and naïve Bayes.The experiments use an Intel Core 2 Duo 2.0 GHz processor with 1 GB of RAM.
- Experimental Analysis: The proposed algorithm is also tested with reduced datasets containing 12 and 17 attributes, which increase detection rates for intrusion classes.The reduced-dataset results are summarized in Table 7.
6. CONCLUSIONS AND FUTURE WORKS
The proposed hybrid Naive Bayes–ID3 algorithm achieved 99% accuracy on the five KDD99 attack classes while minimizing false positives and balancing detection rates. Future work targets reducing false positives for R2L attacks and deploying the model in real-world IDS.
- 99% accuracy was achieved for attacks in the five-class KDD99 benchmark using the proposed hybrid algorithm.
- The algorithm minimized false positives and maximized balanced detection rates across the KDD99 attack classes.
- Future work focuses on improving false positives for remote-to-user (R2L) attacks.
- The authors also plan to apply the detection model to real-world intrusion detection systems.
Authors
The paper's authors include researchers and faculty affiliated with ERIC Laboratory, University Lumière Lyon 2, and Jahangirnagar University. Their backgrounds span computer science, information systems, data warehousing, and security.
- Dewan Md. Farid is a research fellow at ERIC Laboratory and a faculty member in computer science and engineering.
- Nouria Harbi is research staff at ERIC Laboratory working on security of decisional information systems and data-warehouse modelling.
- Mohammad Zahidur Rahma is a computer science and engineering professor at Jahangirnagar University and a book co-author.