Hierarchical Core Vector Machines for Network Intrusion Detection

Authors:
Ye Chen;Shaoning Pang;Nikola Kasabov;Tao Ban;Youki Kadobayashi
Affiliations:
Knowledge Engineering & Discover Research Institute, Auckland University of Technology, Auckland, New Zealand 1020;Knowledge Engineering & Discover Research Institute, Auckland University of Technology, Auckland, New Zealand 1020;Knowledge Engineering & Discover Research Institute, Auckland University of Technology, Auckland, New Zealand 1020;Information Security Research Center, National Institute of Information and Communications Technology, Tokyo, Japan 184-8795;Information Security Research Center, National Institute of Information and Communications Technology, Tokyo, Japan 184-8795
Venue:
ICONIP '09 Proceedings of the 16th International Conference on Neural Information Processing: Part II
Year:
2009

Citing 4
Cited 0

Approximate minimum enclosing balls in high dimensions using core-sets

Journal of Experimental Algorithmics (JEA)
Core Vector Machines: Fast SVM Training on Very Large Data Sets

The Journal of Machine Learning Research
MailRank: using ranking for spam detection

Proceedings of the 14th ACM international conference on Information and knowledge management
Decision trees for hierarchical multilabel classification: a case study in functional genomics

PKDD'06 Proceedings of the 10th European conference on Principle and Practice of Knowledge Discovery in Databases

Quantified Score

Hi-index	0.00

Visualization

Abstract

For labelling network intrusions as they state hierarchical multi-label structure, we develop a hierarchical core vector machines (HCVM) algorithm for high-speed network intrusion detection via hierarchical multi-label classification of network data. HCVM models a multi-label hierarchy into a data Hyper-Sphere constructed by numbers of core vector machines (CVM). As the CVMs in an HCVM are separating, encompassing and overlapping with each other, which forms naturally a tree structure representing the multi-label hierarchy encoded. Provided an unlabelled sample, the HCVM seeks a CVM enclosing the sample, and multiply label the sample according to the MEB's position in the hierarchy. The proposed HCVM method has been examined on KDD'99 and the result shows that the proposed HCVM has significant improvement over previously published benchmark works. HCVM improves U2R accuracy from 13.2% to 82.7% and R2L from 8.4% to 45.9%, as compared to the winner of KDD'99. In particular, the efficiency of HCVM is highlighted, as the computational time stays steady while the size of training data exponentially manifolds.