Improved intrusion detection method for communication networks using association rule mining and artificial neural networks

Abstract

Nowadays, detecting anomaly events in communication networks is highly under consideration by many researchers. In a large communication network, traffic is massive, which leads to a larger amount of data travelling and also the growth of noise. Therefore, to extract meaningful data for anomaly detection would be very challenging. Each attack has its own behaviour that determines the type of attack. However, some attacks may have similar behaviours and only differ in some features. Extracting such meaningful features is of special importance. In this study, an association rule mining algorithm, in particular, the Apriori algorithm is employed to extract appropriate features from the raw data including rules and repetitive patterns. The extracted features would be used then for classifying the data and detecting anomalies in communication networks. A hybrid of artificial neural network and AdaBoost classification algorithms are employed for classifying the detected events with normal behaviour and attack events. The proposed method is compared with previous methods reported in this field such as CART, CHAID, multiple linear regression and logistic regression on KDDCUP99 data set. The results showed that the proposed method outperformed other classifiers examined. The strategy of reinforcement learning is used to combine the classifier's results which is based on Max vote strategy.