Abstract
In this paper, we present a two-stage classifier based on RepTree algorithm and protocols subset for network intrusion detection system. To evaluate the performance of our approach, we used the UNSW-NB15 data set and the NSL-KDD data set. In first phase our approach divides the incoming network traffics into three type of protocols TCP, UDP or Other, then classifies into normal or anomaly. In second stage a multiclass algorithm classify the anomaly detected in the first phase to identify the attacks class in order to choose the appropriate intervention. The number of features is reduced from over 40 to less than 20 features, according to the protocol, using feature selection techniques. The detection accuracy of 88,95% and 89,85% was achieved on the complete UNSW-NB15 and NSL-KDD data set, respectively using individual classifier, results are better as compared to the recent work on these data sets.
Highlights
The emerging Internet of Things together with the rapid growth of computer networks, connected devices, web applications and cloud computing, highlight more than ever, the need for accurate and efficient network security
For the multi-class classification results on the UNSWNB15 dataset, Table VI shows a better accuracy with decision for REPTree and lower accuracy when using nave Bayes or neural networks and prediction was very difficult on other protocols
We proposed a two stage classification network intrusion detection system based on the REPTree algorithm
Summary
The emerging Internet of Things together with the rapid growth of computer networks, connected devices, web applications and cloud computing, highlight more than ever, the need for accurate and efficient network security. An Intrusion Detection System (IDS) is used to identify an unauthorized or malicious action which can compromise the confidentiality, integrity or availability of an information resource [1]. In case of such a detection, the IDS requires the network administrator to intervene. Detection response time and overhead are two of the most challenging issues of a modern IDS since computer networks and data information are continuously changing and increasing, making a real-time intrusion detection is a critical feature of a modern IDS [4]. A false positive (FP) case is considered when the IDS identifies an activity as an attack but the actual activity is a normal one.
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callMore From: International Journal of Advanced Computer Science and Applications
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
