Tags

Type your tag names separated by a space and hit enter

Intrusion detection using rough set classification.
J Zhejiang Univ Sci. 2004 Sep; 5(9):1076-86.JZ

Abstract

Recently machine learning-based intrusion detection approaches have been subjected to extensive researches because they can detect both misuse and anomaly. In this paper, rough set classification (RSC), a modern learning algorithm, is used to rank the features extracted for detecting intrusions and generate intrusion detection models. Feature ranking is a very critical step when building the model. RSC performs feature ranking before generating rules, and converts the feature ranking to minimal hitting set problem addressed by using genetic algorithm (GA). This is done in classical approaches using Support Vector Machine (SVM) by executing many iterations, each of which removes one useless feature. Compared with those methods, our method can avoid many iterations. In addition, a hybrid genetic algorithm is proposed to increase the convergence speed and decrease the training time of RSC. The models generated by RSC take the form of "IF-THEN" rules, which have the advantage of explication. Tests and comparison of RSC with SVM on DARPA benchmark data showed that for Probe and DoS attacks both RSC and SVM yielded highly accurate results (greater than 99% accuracy on testing set).

Authors+Show Affiliations

Department of Computer Science and Engineering, Shanghai Jiaotong University, Shanghai 200030, China. a000309035@21cn.comNo affiliation info availableNo affiliation info availableNo affiliation info available

Pub Type(s)

Comparative Study
Evaluation Study
Journal Article
Research Support, Non-U.S. Gov't

Language

eng

PubMed ID

15323002

Citation

Zhang, Lian-hua, et al. "Intrusion Detection Using Rough Set Classification." Journal of Zhejiang University. Science, vol. 5, no. 9, 2004, pp. 1076-86.
Zhang LH, Zhang GH, Zhang J, et al. Intrusion detection using rough set classification. J Zhejiang Univ Sci. 2004;5(9):1076-86.
Zhang, L. H., Zhang, G. H., Zhang, J., & Bai, Y. C. (2004). Intrusion detection using rough set classification. Journal of Zhejiang University. Science, 5(9), 1076-86.
Zhang LH, et al. Intrusion Detection Using Rough Set Classification. J Zhejiang Univ Sci. 2004;5(9):1076-86. PubMed PMID: 15323002.
* Article titles in AMA citation format should be in sentence-case
TY - JOUR T1 - Intrusion detection using rough set classification. AU - Zhang,Lian-hua, AU - Zhang,Guan-hua, AU - Zhang,Jie, AU - Bai,Ying-cai, PY - 2004/8/24/pubmed PY - 2005/2/11/medline PY - 2004/8/24/entrez SP - 1076 EP - 86 JF - Journal of Zhejiang University. Science JO - J Zhejiang Univ Sci VL - 5 IS - 9 N2 - Recently machine learning-based intrusion detection approaches have been subjected to extensive researches because they can detect both misuse and anomaly. In this paper, rough set classification (RSC), a modern learning algorithm, is used to rank the features extracted for detecting intrusions and generate intrusion detection models. Feature ranking is a very critical step when building the model. RSC performs feature ranking before generating rules, and converts the feature ranking to minimal hitting set problem addressed by using genetic algorithm (GA). This is done in classical approaches using Support Vector Machine (SVM) by executing many iterations, each of which removes one useless feature. Compared with those methods, our method can avoid many iterations. In addition, a hybrid genetic algorithm is proposed to increase the convergence speed and decrease the training time of RSC. The models generated by RSC take the form of "IF-THEN" rules, which have the advantage of explication. Tests and comparison of RSC with SVM on DARPA benchmark data showed that for Probe and DoS attacks both RSC and SVM yielded highly accurate results (greater than 99% accuracy on testing set). SN - 1009-3095 UR - https://www.unboundmedicine.com/medline/citation/15323002/Intrusion_detection_using_rough_set_classification_ L2 - http://www.jzus.zju.edu.cn/article.php?doi=10.1631/jzus.2004.1076 DB - PRIME DP - Unbound Medicine ER -