A new intrusion detection system using support vector machines and hierarchical clustering

摘要: Whenever an intrusion occurs, the security and value of a computer system is compromised. Network-based attacks make it difficult for legitimate users to access various network services by purposely occupying or sabotaging resources services. This can be done sending large amounts traffic, exploiting well-known faults in networking services, overloading hosts. Intrusion Detection attempts detect examining data records observed processes on split into two groups, anomaly detection systems misuse systems. Anomaly attempt search malicious behavior that deviates from established normal patterns. Misuse used identify intrusions match known attack scenarios. Our interest here our proposed method scalable solution detecting network-based anomalies. We use Support Vector Machines (SVM) classification. The SVM one most successful classification algorithms mining area, but its long training time limits use. paper presents study enhancing SVM, specifically when dealing with sets, using hierarchical clustering analysis. Dynamically Growing Self-Organizing Tree (DGSOT) algorithm because has proved overcome drawbacks traditional (e.g., agglomerative clustering). Clustering analysis helps find boundary points, which are qualified points train between classes. present new approach combination DGSOT, starts initial set expands gradually structure produced DGSOT algorithm. compare Rocchio Bundling technique random selection terms accuracy loss gain single benchmark real set. show variations contribute significantly improving process high generalization outperform technique.