A novel hybrid intrusion detection method integrating anomaly detection with misuse detection

Cited 275 time in webofscience Cited 345 time in scopus
  • Hit : 766
  • Download : 359
DC FieldValueLanguage
dc.contributor.authorKim, Gisungko
dc.contributor.authorLee, Seungminko
dc.contributor.authorKim, Sehunko
dc.date.accessioned2014-08-26T08:18:53Z-
dc.date.available2014-08-26T08:18:53Z-
dc.date.created2013-11-08-
dc.date.created2013-11-08-
dc.date.issued2014-03-
dc.identifier.citationEXPERT SYSTEMS WITH APPLICATIONS, v.41, no.4, pp.1690 - 1700-
dc.identifier.issn0957-4174-
dc.identifier.urihttp://hdl.handle.net/10203/187086-
dc.description.abstractIn this paper, a new hybrid intrusion detection method that hierarchically integrates a misuse detection model and an anomaly detection model in a decomposition structure is proposed. First, a misuse detection model is built based on the C4.5 decision tree algorithm and then the normal training data is decomposed into smaller subsets using the model. Next, multiple one-class SVM models are created for the decomposed subsets. As a result, each anomaly detection model does not only use the known attack information indirectly, but also builds the profiles of normal behavior very precisely. The proposed hybrid intrusion detection method was evaluated by conducting experiments with the NSL-KDD data set, which is a modified version of well-known KDD Cup 99 data set. The experimental results demonstrate that the proposed method is better than the conventional methods in terms of the detection rate for both unknown and known attacks while it maintains a low false positive rate. In addition, the proposed method significantly reduces the high time complexity of the training and testing processes. Experimentally, the training and testing time of the anomaly detection model is shown to be only 50% and 60%, respectively, of the time required for the conventional models. (C) 2013 Elsevier Ltd. All rights reserved.-
dc.languageEnglish-
dc.publisherPERGAMON-ELSEVIER SCIENCE LTD-
dc.subjectCLASSIFICATION-
dc.subjectCLASSIFIERS-
dc.subjectSUPPORT-
dc.titleA novel hybrid intrusion detection method integrating anomaly detection with misuse detection-
dc.typeArticle-
dc.identifier.wosid000329955900017-
dc.identifier.scopusid2-s2.0-84888315965-
dc.type.rimsART-
dc.citation.volume41-
dc.citation.issue4-
dc.citation.beginningpage1690-
dc.citation.endingpage1700-
dc.citation.publicationnameEXPERT SYSTEMS WITH APPLICATIONS-
dc.identifier.doi10.1016/j.eswa.2013.08.066-
dc.embargo.liftdate9999-12-31-
dc.embargo.terms9999-12-31-
dc.contributor.localauthorKim, Sehun-
dc.contributor.nonIdAuthorLee, Seungmin-
dc.type.journalArticleArticle-
dc.subject.keywordAuthorHybrid intrusion detection-
dc.subject.keywordAuthorOne-class SVM-
dc.subject.keywordAuthorAnomaly detection-
dc.subject.keywordAuthorDecision tree-
dc.subject.keywordPlusCLASSIFICATION-
dc.subject.keywordPlusCLASSIFIERS-
dc.subject.keywordPlusSUPPORT-
Appears in Collection
IE-Journal Papers(저널논문)
Files in This Item
This item is cited by other documents in WoS
⊙ Detail Information in WoSⓡ Click to see webofscience_button
⊙ Cited 275 items in WoS Click to see citing articles in records_button

qr_code

  • mendeley

    citeulike


rss_1.0 rss_2.0 atom_1.0