One-class intrusion detection system based on KPCA space-similarity

Abstract

To solve the problems of difficult obtaining of the abnormal samples in network intrusion detection application and overfitting of conventional classifications due to the abnormal data unevenly distributed,a novel one-class detection model based on Kernel Principal Component Analysis(KPCA)space similarity and immune principle was presented.The KPCA was employed to extract the nonlinear distribution characteristics of normal samples,and normal samples' characteristic sub-space was consequently established.Other samples' projection onto the sub-space was used to be the metrics of similarity with the normal sub-space.In order to efficiently explore the available abnormal training samples,self-adaptive incorporated immune items were adopted to improve the performance of the proposed model's detection.The kernel function's parameters and threshold value setting were also analyzed and the deciding model based on the Particle Swarm Optimization(TPO)was provided.The detection scheme based on KPCA space similarity was compared with Multi-Layer Perception(MLP),Support Vector Machine(SVM)and Self-Organizing Map(SOM)detection techniques in the experiments.The experimental results illustrate the correctness and effectiveness of the investigated techniques.