A Hybrid Intrusion Detection System Based on Decision Tree and Support Vector Machine

As the use of network services increase, security is considered as a crucial and major issue in the network. Several computers connected with the network play an essential role in business and other applications running over the network to provide services. Therefore, we need to search out the best ways to protect the system. One of the methods is to provide security to the system and analyze network traffic through intrusion detection or intrusion prevention. In this paper, a hybrid intrusion detection framework is suggested. Proposed hybrid IDS is a combination of two machine learning algorithms J48 DT and SVM. To select relevant features from the KDD CUP dataset Particle Swarm Optimization is used. WEKA is used to implement classification on the KDD CUP dataset. The dataset is divided into ratios of 60:40, 70:30, and 80:20 for training and testing purpose. The experiment result showed 99.1% accuracy, 99.6% detection rate and 1.0% FAR for 60:40 datasets whereas accuracy, detection rate and FAR for 70:30 datasets are 99.2%, 99.6% and 0.9% respectively for 80:20 datasets 99.1%, 99.6% and 0.9% respectively.

I. Introduction

Intrusion Detection System is a security software that analyzes network traffic for suspicious action and issues alert signals when such action is found. It examines the network by collecting an adequate amount of data and detecting sensor nodes' abnormal behavior. Intrusion Detection System(IDS) also checks illegal access to the system and inappropriate use of the system. Such detection methods are instrumental in identifying unauthorized access, hackers and traders, masquerading software's, etc. [1]. IDS congregate data from the traffic within a computer system or from a network and is known as audit data. This audit data is analyzed to detect any violation in the system security policy, and in case any security breach is identified, a security break is concluded. This violation in security is possible from two ends, one from inside the network or from the outside the network. There are two methods for intrusion detection misuse detection and the anomaly detection [2]. In the misuse detection method, IDS examines the data it collects and relates it with an extensive database of known attack patterns. Attack patterns are kept in the database, and each packet is matched with patterns in the database; if it is a malicious packet, an alert is generated. Anomaly detection method aims to reveal abnormal behavior of the system. The two methods have their own advantages and disadvantages. The misuse detection method has a low False Positive Rate, yet it can’t reveal new assaults. In the anomaly detection method, new threats can be detected, generating rule is a difficult task.