An Improved Intrusion Detection Algorithm Based on GA and SVM

Peiying Tao,Zhe Sun,Zhixin Sun

doi:10.1109/access.2018.2810198

Peiying Tao, Zhe Sun + Show 1 more

Open Access

https://doi.org/10.1109/access.2018.2810198

Copy DOI

Journal: IEEE Access	Publication Date: Jan 1, 2018
Citations: 180	License type: CC BY 3.0

Affiliation: Nanjing University of Posts and Telecommunications

Abstract

In the era of big data, with the increasing number of audit data features, human-centered smart intrusion detection system performance is decreasing in training time and classification accuracy, and many support vector machine (SVM)-based intrusion detection algorithms have been widely used to identify an intrusion quickly and accurately. This paper proposes the FWP-SVM-genetic algorithm (GA) (feature selection, weight, and parameter optimization of support vector machine based on the genetic algorithm) based on the characteristics of the GA and the SVM algorithm. The algorithm first optimizes the crossover probability and mutation probability of GA according to the population evolution algebra and fitness value; then, it subsequently uses a feature selection method based on the genetic algorithm with an innovation in the fitness function that decreases the SVM error rate and increases the true positive rate. Finally, according to the optimal feature subset, the feature weights and parameters of SVM are simultaneously optimized. The simulation results show that the algorithm accelerates the algorithm convergence, increases the true positive rate, decreases the error rate, and shortens the classification time. Compared with other SVM-based intrusion detection algorithms, the detection rate is higher and the false positive and false negative rates are lower.

Highlights

With the development and popularization of information and network technologies, network information security is becoming more and more important
With the advent of the era of big data, support vector machine (SVM) encounters the problem of long training and testing times, high error rates and low true positive rates, which limit the use of SVM in network intrusion detection
In [11], the genetic algorithm (GA) was proposed to improve the intrusion detection system (IDS) based on support vector machine (SVM), and the optimal feature subset was selected for SVM

Summary

INTRODUCTION

With the development and popularization of information and network technologies, network information security is becoming more and more important. The question of how to improve the effectiveness of smart network intrusion detection has become a focus of network security [1]. SVM, one of the machine learning technologies, is a new algorithm based on statistical learning theory that has shown higher performance than the traditional learning methods in solving the classification problem of pattern recognition and speech recognition [2]. With the advent of the era of big data, SVM encounters the problem of long training and testing times, high error rates and low true positive rates, which limit the use of SVM in network intrusion detection. SVM feature selection, feature weighting and SVM parameter setting are critical to improved detection performance. GA and SVM are used to select the optimal feature subset and optimize the SVM parameters and feature weights to improve the performance of the network intrusion detection system. Tao et al.: Improved Intrusion Detection Algorithm Based on GA and SVM the genetic algorithms (including selection operators, and optimized crossover and mutation probability), Section IV presents an improved intrusion detection method based on GA and SVM (including selection of the optimal feature subset and optimization of the SVM parameters and feature weighting), Section V verifies the effectiveness of the FWPSVM-GA algorithm by comparing the experimental results with other methods of intrusion detection, and Section VI presents conclusions

RELATED WORK

OPTIMIZED CROSSOVER PROBABILITY

OPTIMIZED MUTATION PROBABILITY

CONCLUSION