一個混合式的分類演算法應用於入侵偵測系統

A Hybrid Classification Algorithm for Intrusion Detection System

陳則宏(Ze-Hong Chen)；陳羿霖(Yi-Lin Chen)；張維晏(Wei-Yan Chang)；蔡崇煒(Chun-Wei Tsai)

入侵偵測系統 ； 分類演算法 ； 超啟發式演算法 ； Intrusion detection system ； classification algorithm ； metaheuristic algorithm

資訊安全通訊

25卷1期（2019 / 02 / 01）

14 - 27

繁體中文

入侵偵測系統可以被視為網路管理系統中，用於檢查與警示異常網路行為之子系統。隨著網際網路發展以及網路架構複雜程度增加，許多不同的攻擊方式因此而產生。傳統的入侵偵測系統，無法有效地偵測出這些攻擊，因此本研究提出一個混合式的分類演算法應用於入侵偵測系統，提高系統判斷異常攻擊行為的準確度，並減少分類演算法的計算時間。這個方法結合k-means分群演算法、支持向量機分類演算法以及搜尋經濟學超啟發式演算法。實驗結果說明利用這個混合式的策略，可以讓入侵偵測系統在較複雜的網路攻擊分類問題上，提供較高的準確度。

An intrusion detection system (IDS), which can be regarded as a subsystem of a network management system, plays the role of detecting and preventing abnormal network behaviors. With the advance of the Internet and the increase of the complexity of network architectures, many attack methods have been developed. However, most traditional intrusion detection systems are incapable of recognizing these attacks. Therefore, this study will present a hybrid classification algorithm for an intrusion detection system to improve its accuracy rate and reduce its computation time. The proposed algorithm integrates k-means (a clustering algorithm), support vector machine (a classification algorithm), and search economic (a metaheuristic algorithm). The experimental results show that the proposed hybrid algorithm provides a better accuracy rate in solving complex network attack classification problems.

1. https://github.com/somethingnew2-0/CS642-HW2/blob/master/traces/synflood.pcap, A vailable: 2019/02/22, Available: 2019/02/22.
2. https://sites.google.com/a/uah.edu/tommy-morris-uah/ics-data-sets, Available: 2019/02/22.
3. http://www.unb.ca/research/iscx/dataset/iscx-NSL-KDDdataset.html, Available: 2019/02/22.
4. https://github.com/onty/trace-samples/blob/master/DIAMETER/ESy/EsyAndGy-Normal.pcap, Available: 2019/02/22, Available: 2019/02/22.
5. https://github.com/VishwaPrabhakar/MaliciousIPScanner/blob/master/goldeneye.pcap, Available: 2019/02/22, Available: 2019/02/22
6. https://www.dropbox.com/sh/kk24ewnqi9qjdvt/AAAz0ySsffUi8B8yoPSE5kc3a/pcaps?dl=0, Available: 2019/02/22
7. Ashfaq, R. A. R.,Wang, X. Z.,Huang, J. Z.,Abbas, H.,He, Y. L.(2017).Fuzziness based semi-supervised learning approach for intrusion detection system.Information Sciences,378,484-497.
8. Blum, C.,Roli, A.(2003).Metaheuristics in combinatorial optimization: Overview and conceptual comparison.ACM Computing Surveys,35(3),268-308.
9. Burguera, I.,Zurutuza, U.,Nadjm-Tehrani, S.(2011).Crowdroid: Behavior-based malware detection system for android.Proceedings of the ACM Workshop on Security and Privacy in Smartphones and Mobile Devices
10. Casas, P.,Mazel, J.,Owezarski, P.(2012).Unsupervised network intrusion detection systems: Detecting the unknown without knowledge.Computer Communications,35,772-783.
11. Chen, Z.H.,Tsai, C.W.(2018).An Effective Metaheuristic Algorithm for Intrusion Detection System.Proceedings of the IEEE International Conference on Smart Internet of Things
12. Depren, O.,Topallar, M.,Anarim, E.,Ciliz, M. K.(2005).An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks.Expert Systems with Applications,29(4),713-722.
13. Kashef, S.,Nezamabadi-pour, H.(2015).An advanced ACO algorithm for feature subset selection.Neurocomputing,147,271-279.
14. Kuang, F.,Xu, W.,Zhang, S.(2014).A novel hybrid KPCA and SVM with GA model for intrusion detection.Applied Soft Computing,18,178-184.
15. Lee, K. C.,Mikhailov, L.(2004).Intelligent intrusion detection system.Proceedings of the International IEEE Conference on Intelligent Systems
16. Liao, H. J.,Lin, C. H. R.,Lin, Y. C.,Tung, K. Y.(2013).Intrusion detection system: A comprehensive review.Network and Computer Applications,36(1),16-24.
17. Lin, S. W.,Ying, K. C.,Chen, S. C.,Lee, Z. J.(2008).Particle swarm optimization for parameter determination and feature selection of support vector machines.Expert Systems with Applications,35(4),1817-1824.
18. Lunt, T. F.(1993).A survey of intrusion detection techniques.Computers & Security,12(4),405-418.
19. Mairh, A.,Barik, D.,Verma, K.,Jena, D.(2011).Honeypot in network security: A survey.Proceedings of the International Conference on Communication, Computing & Security
20. Michel, C.,Mé, L.(2001).ADeLe: An Attack Description Language for Knowledge-Based Intrusion Detection.Proceedings of the IFIP International Information Security Conference
21. Patel, A.,Taghavi, M.,Bakhtiyari, K.,Júnior, J. C.(2013).An intrusion detection and prevention system in cloud computing: A systematic review.Journal of Network and Computer Applications,36(1),25-41.
22. Ring, M.,Wunderlich, S.,Grdl, D.,Landes, D.,Hotho, A.(2017).Flow-based benchmark data sets for intrusion detection.Proceedings of the 16th European Conference on Cyber Warfare and Security
23. Saied, A.,Overill, R. E.,Radzik, T.(2016).Detection of known and unknown DDOS attacks using artificial neural networks.Neurocomputing,172,385-393.
24. Stallings, W.,Brown, L.(2014).Incident Response: Computer Security Principles and Practice.Prentice Hall Press.
25. Stein, G.,Chen, B.,Wu, A. S.,Hua, K. A.(2005).Decision tree classifier for network intrusion detection with GA-based feature selection.Proceedings of the Annual Southeast Regional Conference
26. Tsai, C. W.(2016).An effective WSN deployment algorithm via search economics.Computer Networks,101,178-191.
27. Tsai, C.W.(2013).Incremental Particle Swarm Optimization for Intrusion Detection.IET Networks,2(3),124-130.
28. Vilela, D. W. F. L.,Ferreira, E. W. T.,Shinoda, A. A.,de Souza Arajo, N. V.,de Oliveira, R.,Nascimento, V. E.(2014).A dataset for evaluating intrusion detection systems in IEEE 802.11 wireless networks.Proceedings of the IEEE Colombian Conference on Communications and Computing

1. 蔡崇煒,陳煥,陳羿霖,張維晏(2020)。一個有效的深度學習超參數選擇方法應用於入侵偵測系統。資訊安全通訊，26(4)，1-16。
2. 程湲晏,陳祐祥,曹慧華,丁敏慧(2020)。先進分類模式於保費數據分析之應用。管理資訊計算，9(特刊2)，112-120。