Enhanced boosting-based algorithm for intrusion detection in virtual machine environments

Authors:
Malak Alshawabkeh;David Kaeli;Javed A. Aslam;Jennifer G. Dy;Dana Schaa
Affiliations:
Northeastern University, Boston, MA;Northeastern University, Boston, MA;Northeastern University, Boston, MA;Northeastern University, Boston, MA;Northeastern University, Boston, MA
Venue:
Proceedings of the First International Workshop on Secure and Resilient Architectures and Systems
Year:
2012

Citing 3
Cited 0

Feature selection for text categorization on imbalanced data

ACM SIGKDD Explorations Newsletter - Special issue on learning from imbalanced datasets
Data Mining: Practical Machine Learning Tools and Techniques, Second Edition (Morgan Kaufmann Series in Data Management Systems)

Data Mining: Practical Machine Learning Tools and Techniques, Second Edition (Morgan Kaufmann Series in Data Management Systems)
Effective Virtual Machine Monitor Intrusion Detection Using Feature Selection on Highly Imbalanced Data

ICMLA '10 Proceedings of the 2010 Ninth International Conference on Machine Learning and Applications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Intrusion detection is one of the high priority and challenging tasks in many technologies, particularly, in virtualization technology. There is a need to safeguard these systems from known vulnerabilities and at the same time take steps to detect new and unseen, but possible, system abuses by developing more reliable and efficient intrusion detection systems. In this correspondence, we propose a machine learning based intrusion detection algorithm based on Enhanced Boosting with Decision Stumps algorithm to detect various categories of attacks utilizing information embedded within the virtual machine monitor (VMM) level. In the algorithm, decision stumps are used as weak classifiers. The decision rules are provided for different types of features. By combining the weak classifiers for the heterogeneous mixture features types into a strong classifier, the relations between these features are handled naturally, without any forced conversions between them. Moreover, adjustable initial weights based on the area under the ROC curve (AUC) are adopted to make a tradeoff between the false-alarm and detection rates. Experimental results show that our algorithm has low computational complexity and error rates as tested on real malwares.