A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM

Treepop Wisanwanichthan,Mason Thammawichai

doi:10.1109/access.2021.3118573

Abstract

A pattern matching method (signature-based) is widely used in basic network intrusion detection systems (IDS). A more robust method is to use a machine learning classifier to detect anomalies and unseen attacks. However, a single machine learning classifier is unlikely to be able to accurately detect all types of attacks, especially uncommon attacks e.g., Remote2Local (R2L) and User2Root (U2R) due to a large difference in the patterns of attacks. Thus, a hybrid approach offers more promising performance. In this paper, we proposed a Double-Layered Hybrid Approach (DLHA) designed specifically to address the aforementioned problem. We studied common characteristics of different attack categories by creating Principal Component Analysis (PCA) variables that maximize variance from each attack type, and found that R2L and U2R attacks have similar behaviour to normal users. DLHA deploys Naive Bayes classifier as Layer 1 to detect DoS and Probe, and adopts SVM as Layer 2 to distinguish R2L and U2R from normal instances. We compared our work with other published research articles using the NSL-KDD data set. The experimental results suggest that DLHA outperforms several existing state-of-the-art IDS techniques, and is significantly better than any single machine learning classifier by large margins. DLHA also displays an outstanding performance in detecting rare attacks by obtaining a detection rate of 96.67% and 100% from R2L and U2R respectively.

Highlights

Due to a dramatic increase of attacks on machines and network-based services, cyber security has become an essential topic in protecting systems from threats at a local and global scale over the past decades
In order to address the above problems, our contributions to the cyber security domain are as follows: (I) We proposed a Double-Layered Hybrid Approach (DLHA) that is better than a single Machine Learning (ML) classifier and the ensemble method
It is worth mentioning that there are a number of existing works that previously studied anomaly-based intrusion detection systems (IDS) using a refined version of the KDD99 i.e., NSL-KDD [1], the same data set we considered in this study

Summary

INTRODUCTION

Due to a dramatic increase of attacks on machines and network-based services, cyber security has become an essential topic in protecting systems from threats at a local and global scale over the past decades. The main concept behind the hybrid approach is to exploit the advantages of each learning technique by combining the strong points of different single classifiers in order to improve the overall detection rate. (I) Many works e.g., [37], [47] only focused on using a single machine learning model to detect all attack types This led to a drawback of a single classifier that is difficult to outperform a hybrid approach. In order to address the above problems, our contributions to the cyber security domain are as follows: (I) We proposed a Double-Layered Hybrid Approach (DLHA) that is better than a single ML classifier and the ensemble method.

RELATED WORK

Evaluation Criteria

PROPOSED METHODOLOGY

EVALUATION AND RESULT

Our proposed DLHA

CONCLUSION