入侵检测中基于SVM的两级特征选择方法

doi:10.11959/j.issn.1000-436x.2015127

Abstract

Abstract:

To select optimized features for intrusion detection，a two-level feature selection method based on support vector machine was proposed.This method set an evaluation index named feature evaluation value for feature selection，which was the ratio of the detection rate and false alarm rate.Firstly，this method filtrated noise and irrelevant features to reduce the feature dimension respectively by Fisher score and information gain in the filtration mode.Then，a crossing feature subset was obtained based on the above two filtered feature sets.And combining support vector machine，the sequential backward selection algorithm in the wrapper mode was used to select the optimal feature subset from the crossing feature subset.The simulation test results show that，the better classification performance is obtained according to the selected optimal feature subset，and the modeling time and testing time of the system are reduced effectively.

Key words: intrusion detection, feature selection, support vector machine, Fisher score, sequential backward selection

Xiao-nian WU,Xiao-jin PENG,Yu-yang YANG,Kun FANG. Two-level feature selection method based on SVM for intrusion detection[J]. Journal on Communications, 2015, 36(4): 19-26.

Figures/Tables 7

References 16

[1]	ZHANG Y ， YANG A ， XIONG C ，et al. Feature selection using data envelopment analysis[J]. Knowledge-Based Systems， 2014，64: 70-80.
[2]	LEE M C . Using support vector machine with a hybrid feature selection method to the stock trend prediction[J]. Expert Systems with Applications， 2009，36(8): 10896-10904.
[3]	YONGLI Z ， YUNG Z ， WEI M T ，et al. An improved feature selectionalgorithm based on MAHALANOBIS distance for network intrusion detection[A]. Sensor Network Security Technology and Privacy Communication System (SNS & PCS)，2013 International Conference on[C]. 2013. 69-73.
[4]	TESFAHUN A ， BHASKARI D L . Intrusion detection using random forests classifier with SMOTE and feature reduction[A]. Cloud &Ubiquitous Computing & Emerging Technologies (CUBE)，2013 International Conference on[C]. 2013. 127-132.
[5]	ARAUJO N V S ， OLIVEIRA R ， FERREIRA E W T ，et al. Kappa-fuzzy aRTMAP:a feature selection based methodology to intrusion detection in computer networks[A]. Trust，Security and Privacy in Computing and Communications (TrustCom)，2013 12th IEEE International Conference on[C]. 2013. 271-276.
[6]	ZHANG F ， WANG D . An effective feature selection approach for network intrusion detection[A]. Networking，Architecture and Storage (NAS)，2013 IEEE Eighth International Conference on[C]. 2013. 307-311.
[7]	HSU H H ， HSIEH C W ， LU M D . Hybrid feature selection by combining filters and wrappers[J]. Expert Systems with Applications， 2011，38(7): 8144-8150.
[8]	XIE J ， WANG C . Using support vector machines with a novel hybrid feature selection method for diagnosis of erythemato-squamous diseases[J]. Expert Systems with Applications， 2011，38(5): 5809-5815.
[9]	汪廷华，田盛丰，黄厚宽 . 特征加权支持向量机[J]. 电子与信息学报， 2009，31(3): 514-518. WANG T H ， TIAN S F ， HUANG H K . Feature weighted support vector machine[J]. Journal of Electronics & Information Technology， 2009，31(3): 514-518.
[10]	CORTES ， VAPNIK V . Support vector networks[J]. Machine Learning， 1995，20: 273-297.
[11]	汪廷华，陈峻婷 . 核函数的选择研究综述[J]. 计算机工程与设计， 2012，33(3): 1181-1186. WANG T H ， CHEN J T . Survey of research on kernel selection[J]. Computer Engineering and Design， 2012，33(3): 1181-1186.
[12]	KDDCup99KDDdataset[EB/OL]. ， 2011
[13]	LI Y ， XIA J ， ZHANG S ，et al. An efficient intrusion detection system based on support vector machines and gradually feature removal method[J]. Expert Systems with Applications， 2012，39(1): 424-430.
[14]	Q Z，CHUN.H G ， JIA J L . Intrusion detection system based on feature selection and support vector machine[A]. Communications and Networking in China，ChinaCom'06，First International Conference on[C]. 2006. 1-5.
[15]	XIAN J ， PEI Y L ， WEI G ，et al. An algorithm application in intrusion forensics based on improved information gain[A]. Web Society (SWS)，2011 3rd Symposium on[C]. 2011. 100-104.
[16]	BURGES C J C . A tutorial on support vector machines for pattern recognition[J]. Data Mining and Knowledge Discovery， 1998，2(2): 121-167.

Metrics

Recommended 0

No Suggested Reading articles found!

特征集合	特征维数	所含特征
FS_Sub	26	336 33 23 12 24 4 29 34 2 27 40 28 41 39 26 37 10 35 25 38 30 22 5 32 14
IG_Sub	28	5 3 23 24 33 36 2 32 4 12 29 10 34 39 26 37 27 38 25 40 28 22 41 35 30 6 1 11

特征集合	特征维数	所含特征
F_Cross	25	2 3 4 5 10 12 22 23 24 25 26 27 28 29 30 32 33 34 35 36 37 38 39 40 41

特征选择方法	特征维数	建模时间/s	测试时间/s	检测率/%	误报率/%	分类准确率/%
GFR	19（2 4 8 10 14 15 19 25 27 29 31 32 33 34 35 36 37 38 40）	5.10	2.26	97.83	0.41	99.26
F-Score	19（2 4 6 12 23 24 25 26 29 30 31 32 33 34 35 36 37 38 39）	7.20	2.90	96.60	0.91	98.62
IIG	12（2 3 5 6 8 10 12 23 25 36 37 38）	5.84	2.28	97.36	1.19	98.53
所有特征	原始41维特征	7.63	4.89	97.23	0.23	99.29
本文方法	13（2 3 4 10 12 22 23 28 32 33 34 37 39）	4.48	1.73	98.43	0.31	99.45

特征选择方法	特征维数	建模时间平均偏移值	测试时间平均偏移值	检测率平均偏移值	误报率平均偏移值	分类准确率平均偏移值
GFR	19	0.299 2	0.093 6	0.267 2	0.038 4	0.078 4
F-Score	19	0.445 6	0.119 2	0.192 8	0.018 4	0.036 8
IIG	12	0.298 4	0.076	0.264	0.026 4	0.053 6
所有特征	41	0.246 4	0.068 8	0.274 4	0.024 8	0.059 2
本文方法	13	0.210 4	0.046 4	0.255 2	0.031 2	0.048

Two-level feature selection method based on SVM for intrusion detection

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 7

References 16

Related Articles 15

Metrics

Recommended 0

[1]	Xin SUN, Guifu ZHANG, Hongyan XING, Wang Zenghui. Research on intrusion detection for maritime meteorological sensor network based on balancing generative adversarial network [J]. Journal on Communications, 2023, 44(4): 124-136.
[2]	Shuangyan YI, Yongsheng LIANG, Jingjing LU, Wei LIU, Tao HU, Zhenyu HE. Robust feature selection method via joint low-rank reconstruction and projection reconstruction [J]. Journal on Communications, 2023, 44(3): 209-219.
[3]	Yifeng WANG, Yuanbo GUO, Qingli CHEN, Chen FANG, Renhao LIN. Method based on contrastive learning for fine-grained unknown malicious traffic classification [J]. Journal on Communications, 2022, 43(10): 12-25.
[4]	Qixu LIU, Junnan WANG, Jie YIN, Yanhui CHEN, Jiaxi LIU. Application of adversarial machine learning in network intrusion detection [J]. Journal on Communications, 2021, 42(11): 1-12.
[5]	Youliang TIAN,Yulong WU,Qiuxian LI. Optimum response scheme of intrusion detection based on information theory [J]. Journal on Communications, 2020, 41(7): 121-130.
[6]	Yonghao LI, Liang HU, Ping ZHANG, Wanfu GAO. Multi-label feature selection based on dynamic graph Laplacian [J]. Journal on Communications, 2020, 41(12): 47-59.
[7]	Xinglan ZHANG,Shenglin YIN. Intrusion detection model of random attention capsule network based on variable fusion [J]. Journal on Communications, 2020, 41(11): 160-168.
[8]	Wei SUN,Peng ZHANG,Yongquan HE,Lichao XING. Attack detection method based on spatiotemporal event correlation in intranet environment [J]. Journal on Communications, 2020, 41(1): 33-41.
[9]	Chenyang ZHAO,Junling WANG. Service recommendation method based on context-embedded support vector machine [J]. Journal on Communications, 2019, 40(9): 61-73.
[10]	Xiaochao DANG,Yaning HUANG,Zhanjun HAO,Xiong SI. Passive indoor human daily behavior detection method based on channel state information [J]. Journal on Communications, 2019, 40(4): 160-170.
[11]	Xiaoling YIN,Xiaojiang CHEN,Qishou XIA,Juan HE,Pengyan ZHANG,Feng CHEN. Human motion state recognition based on smart phone built-in sensor [J]. Journal on Communications, 2019, 40(3): 157-169.
[12]	Zhanshan LI, Zhaogeng LIU. Feature selection algorithm based on XGBoost [J]. Journal on Communications, 2019, 40(10): 101-108.
[13]	Li ZHANG,Cong WANG. Multi-label feature selection algorithm based on joint mutual information of max-relevance and min-redundancy [J]. Journal on Communications, 2018, 39(5): 111-122.
[14]	Zhen ZHANG,Peng WEI,Yufeng LI,Julong LAN,Ping XU,Bo CHEN. Feature selection algorithm based on improved particle swarm joint taboo search [J]. Journal on Communications, 2018, 39(12): 60-68.
[15]	Yong WANG,Huiyi ZHOU,Hao FENG,Miao YE,Wenlong KE. Network traffic classification method basing on CNN [J]. Journal on Communications, 2018, 39(1): 14-23.