A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM
A pattern matching method (signature-based) is widely used in basic network intrusion detection systems (IDS). A more robust method is to use a machine learning classifier to detect anomalies and unseen attacks. However, a single machine learning classifier is unlikely to be able to accurately detec...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9562534/ |
| _version_ | 1818425704947122176 |
|---|---|
| author | Treepop Wisanwanichthan Mason Thammawichai |
| author_facet | Treepop Wisanwanichthan Mason Thammawichai |
| author_sort | Treepop Wisanwanichthan |
| collection | DOAJ |
| description | A pattern matching method (signature-based) is widely used in basic network intrusion detection systems (IDS). A more robust method is to use a machine learning classifier to detect anomalies and unseen attacks. However, a single machine learning classifier is unlikely to be able to accurately detect all types of attacks, especially uncommon attacks e.g., Remote2Local (R2L) and User2Root (U2R) due to a large difference in the patterns of attacks. Thus, a hybrid approach offers more promising performance. In this paper, we proposed a Double-Layered Hybrid Approach (DLHA) designed specifically to address the aforementioned problem. We studied common characteristics of different attack categories by creating Principal Component Analysis (PCA) variables that maximize variance from each attack type, and found that R2L and U2R attacks have similar behaviour to normal users. DLHA deploys Naive Bayes classifier as Layer 1 to detect DoS and Probe, and adopts SVM as Layer 2 to distinguish R2L and U2R from normal instances. We compared our work with other published research articles using the NSL-KDD data set. The experimental results suggest that DLHA outperforms several existing state-of-the-art IDS techniques, and is significantly better than any single machine learning classifier by large margins. DLHA also displays an outstanding performance in detecting rare attacks by obtaining a detection rate of 96.67% and 100% from R2L and U2R respectively. |
| first_indexed | 2024-12-14T14:18:11Z |
| format | Article |
| id | doaj.art-211c637fa6e0435eae8e28a21141b5be |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-14T14:18:11Z |
| publishDate | 2021-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-211c637fa6e0435eae8e28a21141b5be2022-12-21T22:58:09ZengIEEEIEEE Access2169-35362021-01-01913843213845010.1109/ACCESS.2021.31185739562534A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVMTreepop Wisanwanichthan0https://orcid.org/0000-0002-9306-0920Mason Thammawichai1https://orcid.org/0000-0003-3761-0913Navaminda Kasatriyadhiraj Royal Air Force Academy, Bangkok, ThailandNavaminda Kasatriyadhiraj Royal Air Force Academy, Bangkok, ThailandA pattern matching method (signature-based) is widely used in basic network intrusion detection systems (IDS). A more robust method is to use a machine learning classifier to detect anomalies and unseen attacks. However, a single machine learning classifier is unlikely to be able to accurately detect all types of attacks, especially uncommon attacks e.g., Remote2Local (R2L) and User2Root (U2R) due to a large difference in the patterns of attacks. Thus, a hybrid approach offers more promising performance. In this paper, we proposed a Double-Layered Hybrid Approach (DLHA) designed specifically to address the aforementioned problem. We studied common characteristics of different attack categories by creating Principal Component Analysis (PCA) variables that maximize variance from each attack type, and found that R2L and U2R attacks have similar behaviour to normal users. DLHA deploys Naive Bayes classifier as Layer 1 to detect DoS and Probe, and adopts SVM as Layer 2 to distinguish R2L and U2R from normal instances. We compared our work with other published research articles using the NSL-KDD data set. The experimental results suggest that DLHA outperforms several existing state-of-the-art IDS techniques, and is significantly better than any single machine learning classifier by large margins. DLHA also displays an outstanding performance in detecting rare attacks by obtaining a detection rate of 96.67% and 100% from R2L and U2R respectively.https://ieeexplore.ieee.org/document/9562534/Correlation feature selectiondouble-layered hybrid approachmachine learningNaive Bayesintrusion detection systemnetwork security |
| spellingShingle | Treepop Wisanwanichthan Mason Thammawichai A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM IEEE Access Correlation feature selection double-layered hybrid approach machine learning Naive Bayes intrusion detection system network security |
| title | A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM |
| title_full | A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM |
| title_fullStr | A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM |
| title_full_unstemmed | A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM |
| title_short | A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM |
| title_sort | double layered hybrid approach for network intrusion detection system using combined naive bayes and svm |
| topic | Correlation feature selection double-layered hybrid approach machine learning Naive Bayes intrusion detection system network security |
| url | https://ieeexplore.ieee.org/document/9562534/ |
| work_keys_str_mv | AT treepopwisanwanichthan adoublelayeredhybridapproachfornetworkintrusiondetectionsystemusingcombinednaivebayesandsvm AT masonthammawichai adoublelayeredhybridapproachfornetworkintrusiondetectionsystemusingcombinednaivebayesandsvm AT treepopwisanwanichthan doublelayeredhybridapproachfornetworkintrusiondetectionsystemusingcombinednaivebayesandsvm AT masonthammawichai doublelayeredhybridapproachfornetworkintrusiondetectionsystemusingcombinednaivebayesandsvm |