DATA MINING BASED HYBRID INTRUSION CLASSIFICATION MODEL

Abstract

Security is becoming a critical part of organizational information systems. Intrusion Detection System (IDS) plays an effective role to achieve higher security in detecting malicious activities for a couple of years. The enormous volume of existing and newly appearing network data that require processing has given data mining classification and other techniques to make several important contributions to the, field of Intrusion Detection. Hence it is important field of research to classify network traffic as intrusion or normal with good detection rate as well less false alarms in time efficient manner. In this dissertation, we propose a hybrid classification model that ensemble Naive Bayes and Decision Table Majority approaches. Naive Bayes is one of the statistical approaches for classification that predicts very fast due to the less complexity functioning of it. Decision Table Majority is one of the powerful rule, based classifier that provides high detection rate with less false alarms but suffers due to higher time complexity. In our hybrid approach we first classify network traffic using Naive Bayes and then reclassify some records(based on condition for reclassification) using Decision Table Majority classifier which is preceded by Correlation Based Feature Selection for selecting important features. We tested performance of our hybrid approach and existing approaches by employing on KDDCup'99 benchmark intrusion detection dataset. The experimental results show better performance in detection rate as well false positive rate with reasonable prediction time.