A weighted intrusion detection model of dynamic selection

Abstract

In view of the difficulty of existing intrusion detection methods in dealing with new forms, large scale, and high concealment of network intrusion behaviors, this paper presents a weighted intrusion detection model of the dynamic selection (WIDMoDS) based on data features. The aim is to customize intrusion detection models for network intrusion data sets of different types, sizes and structures. First, according to data features, single classifiers are clustered using a hierarchical clustering algorithm based on the classifiers evaluation indicators, and then, the classifiers selection is by means of accuracy of the single classifiers, in addition, the data-classifier applicable indicators (DCAI) and of the classifiers performances are used for calculating the weights of subjective and objective, and then calculating combined weight ranks. Finally, a custom intrusion detection model is generated by the Weight-voting (W-voting) algorithm. Our experiments show that this model can optimize the number of classifiers based on the data sets features, reduce the problem of redundant or insufficient classifiers in the ensemble process. A new network intrusion detection model of combining the classifier characteristics with the dataset attributes can improve the accuracy of intrusion detection.