A BOOSTING APPROACH FOR INTRUSION DETECTION

作     者：Zan Xin Han Jiuqiang Zhang Junjie Zheng Qinghua Han Chongzhao 

作者机构：Dept of Automation School of Electronics and Information Engineering Xi＇an Jiaotong University Xi＇an 710040 China 

出 版 物：《Journal of Electronics(China)》 (电子科学学刊（英文版）)

年 卷 期：2007年第24卷第3期

页      面：369-373页

学科分类：0839[工学-网络空间安全] 08[工学] 

基　　金：National High-tech R&D Program of China (2003AA142060) National Basic Research Program of China (2001CB09403) 

主　　题：Network security Intrusion Detection System (IDS) Machine learning Boosting algo-rithm Decision tree Support Vector Machine (SVM) 

摘      要：Intrusion detection can be essentially regarded as a classification problem,namely,dis-tinguishing normal profiles from intrusive behaviors. This paper introduces boosting classification algorithm into the area of intrusion detection to learn attack signatures. Decision tree algorithm is used as simple base learner of boosting algorithm. Furthermore,this paper employs the Principle Com-ponent Analysis (PCA) approach,an effective data reduction approach,to extract the key attribute set from the original high-dimensional network traffic data. KDD CUP 99 data set is used in these ex-periments to demonstrate that boosting algorithm can greatly improve the classification accuracy of weak learners by combining a number of simple “weak learners. In our experiments,the error rate of training phase of boosting algorithm is reduced from 30.2% to 8% after 10 iterations. Besides,this paper also compares boosting algorithm with Support Vector Machine (SVM) algorithm and shows that the classification accuracy of boosting algorithm is little better than SVM algorithm’s. However,the generalization ability of SVM algorithm is better than boosting algorithm.