Hierarchical two-tier ensemble learning: a new paradigm for network intrusion detection

Authors:
Morteza Analoui;Behrouz Minaei Bidgoli;Mohammad Hossein Rezvani
Affiliations:
Iran University of Science and Technology, Tehran, Iran;Iran University of Science and Technology, Tehran, Iran;Iran University of Science and Technology, Tehran, Iran
Venue:
Proceedings of the ACM first Ph.D. workshop in CIKM
Year:
2007

Citing 7
Cited 1

Methods for combining experts' probability assessments

Neural Computation
On Combining Classifiers

IEEE Transactions on Pattern Analysis and Machine Intelligence
A framework for constructing features and models for intrusion detection systems

ACM Transactions on Information and System Security (TISSEC)
Proceedings of the Third International Workshop on Multiple Classifier Systems

MCS '02 Proceedings of the Third International Workshop on Multiple Classifier Systems
Combining Pattern Classifiers: Methods and Algorithms

Combining Pattern Classifiers: Methods and Algorithms
Modeling intrusion detection system using hybrid intelligent systems

Journal of Network and Computer Applications - Special issue: Network and information security: A computational intelligence approach
Issues in stacked generalization

Journal of Artificial Intelligence Research

A fuzzy evolutionary framework for combining ensembles

Applied Soft Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Intrusion detection is a mechanism of providing security to computer networks. Almost all of traditional intelligent intrusion detection systems (IDSs) use a single approach to distinguish normal behavior patterns from attack signatures. Moreover these systems have a high false alarm rate and high cost. The combination of multiple classifiers usually exhibits lower false alarm and overall error rate than individual decisions. On the other hand, the combination of classifiers trained on different feature sets could provide better performances than each single classifier. In this paper, a hierarchical two-level combiner is proposed to detect network intrusions using multiple well-known and efficient base classifiers. The proposed combiner exploits the different recognition capabilities provided by the independent feature representations in the first level as well as the agreement among the classifiers in the second level.