Detecting Malicious Traffic through Two-phase Machine Learning

Abstract

Malicious Internet traffic is increasing with rapidly growing dependence on network technology. Intrusion detection systems (IDSs) are important countermeasure tools for detecting malicious traffic. To deal with the increase in unknown malicious traffic, it is necessary to improve IDS accuracy, which is based on anomaly detection. This study proposes a new method that employs machine learning using the concept of the decision tree and support vector machine (SVM). We examine the existing technologies for anomaly detection with machine learning. This study shows how to improve the accuracy of IDS. Our proposed method attains the highest accuracy, when compared with the existing methods. The results of evaluation show that the new method performs well with a detection rate of 99.58% and a misdetection rate of 0.005%. The processing speed is 11.68 Mbps. Among various evaluation scenarios of the new method, the highest detection rate is 99.98%, the lowest misdetection rate is 0.0005%, and the highest processing speed is 29.90 Mbps. These figures obtained are better than those of existing method we surveyed. Thus, the proposed two-phase machine learning method is quite effective that uses the concept of the decision tree and SVM for anomaly detection.