SVM approach with a genetic algorithm for network intrusion detection

Authors:
Taeshik Shon;Jungtaek Seo;Jongsub Moon
Affiliations:
Center for Information Security Technologies/Graduate School of Information Security, Korea University, Seoul, Korea;National Security Research Institute, Daejeon, Republic of Korea;Center for Information Security Technologies/Graduate School of Information Security, Korea University, Seoul, Korea
Venue:
ISCIS'05 Proceedings of the 20th international conference on Computer and Information Sciences
Year:
2005

Citing 9
Cited 0

Adaptation in natural and artificial systems

Adaptation in natural and artificial systems
The nature of statistical learning theory

The nature of statistical learning theory
Elements of machine learning

Elements of machine learning
An introduction to support Vector Machines: and other kernel-based learning methods

An introduction to support Vector Machines: and other kernel-based learning methods
Learning nonstationary models of normal network traffic for detecting novel attacks

Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining
Statistical Traffic Modeling for Network Intrusion Detection

MASCOTS '00 Proceedings of the 8th International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication Systems
Identifying Important Features for Intrusion Detection Using Support Vector Machines and Neural Networks

SAINT '03 Proceedings of the 2003 Symposium on Applications and the Internet
Information-Theoretic Measures for Anomaly Detection

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Properties of Support Vector Machines

Properties of Support Vector Machines

Quantified Score

Hi-index	0.00

Visualization

Abstract

Due to the increase in unauthorized access and stealing of internet resources, internet security has become a very significant issue. Network anomalies in particular can cause many potential problems, but it is difficult to discern these from normal traffic. In this paper, we focus on a Support Vector Machine (SVM) and a genetic algorithm to detect network anomalous attacks. We first use a genetic algorithm (GA) for choosing proper fields of traffic packets for analysis. Only the selected fields are used, and a time delay processing is applied to SVM for considering temporal relationships among packets. In order to verify our approach, we tested our proposal with the datasets of MIT Lincoln Lab, and then analyzed its performance. Our SVM approach with selected fields showed excellent performance.