Efficient approach to intrusion detection based on boosting rule learning

Jisuanji Yanjiu yu Fazhan/Computer Research and Development

Volumn 43, Issue 7, 2006, Pages 1252-1259

  Yang, Wu ^a   Yun, Xiaochun ^a,b   Li, Jianhua ^a,c  

^a HARBIN ENGINEERING UNIVERSITY   (China)

^b HARBIN INSTITUTE OF TECHNOLOGY   (China)

^c SHANGHAI JIAO TONG UNIVERSITY   (China)

Author keywords

Detection rate; False positive rate; Generalization performance; Intrusion detection; Network security; Rule learning

Indexed keywords

COMPUTER NETWORKS; LEARNING ALGORITHMS; PATTERN RECOGNITION;

DETECTION RATE; FALSE POSITIVE RATE; GENERALIZATION PERFORMANCE; INTRUSION DETECTION; NETWORK SECURITY; RULE LEARNING;

SECURITY OF DATA;

EID: 33747449181     PISSN: 10001239     EISSN: None     Source Type: Journal    
DOI: 10.1360/crad20060718     Document Type: Article

References (15)

1. K. Illgun, R. Kemmerer, P. A. Porras. State transition analysis: A rule-based intrusion detection approach [J]. IEEE Trans. Software Engineering, 1995, 21(3): 181-199
2. K. Sequeira, M. Zaki. ADMIT: Anomaly-based data mining for intrusions [C]. In: Proc. 8th ACM SIGKDD Int'l Conf. Knowledge Discovery and Data Mining. New York: ACM Press, 2002. 386-395
3. J. P. Anderson, et al. Detecting unusual program behavior using the statistical components of NIDES [OL]. http://www.sdl.sri.com/papers/5sri/5sri.pdf, 1995
4. H. Debar, M. Becker, D. Siboni. A neural network component for an intrusion detection system [C]. In: Proc. 1992 IEEE Symposium on Security and Privacy. Los Alamitos: IEEE Computer society Press, 1992. 240-251
5. C. Taylor, J. A. Foss. NATE: Network analysis of anomalous traffic events: A low-cost approach [C]. In: Proc. New Security Paradigms Workshop. New York: ACM Press, 2002. 89-96
6. S. J. Stolfo, A. L. Prodromidis, S. Tselepis, et al. JAM: Java agent for meta-learning over distributed databases [C]. In: Proc. KDD-97 and AAAI'97 Workshop on Al Methods in Fraud and Risk Management. Menlo Park, CA: AAAI Press, 1997. 74-81
7. W. W. Cohen. Efficient rule induction [C]. In: Proc. 12th Int'l Conf. Machine Learning. San Francisco: Morgan Kaufmann, 1995. 115-123
8. L. Wenke, S. J. Stolfo, K. W. Mok. A data mining framework for building intrusion detection models [C]. In: Proc. 1999 IEEE Symposium on Security and Privacy. Piscataway, NJ: IEEE Press, 1999. 120-132
9. R. E. Schapire. The strength of weak learnability [J]. Machine Learning, 1990, 5(2): 197-227
10. W. W. Cohen, S. Yoram. A simple, fast, and effective rule learner [C]. In: Proc. 16th National Conf. Artificial Intelligence. Menlo Park, CA: AAAI Press, 1999. 335-342
11. Y. Freund. Boosting a weak algorithm by majority [J]. Information and Computation, 1995, 121(2): 256-285
12. R. E. Schapire, Y. Singer. Improved boosting algorithms using confidence-rated predictions [J]. Machine Learning, 1999, 37(3): 297-336
13. S. J. Stolfo, W. Fan, L. Wenke, et al. KDD Cup 1999 Intrusion Detection Dataset [OL]. http://www.ics.uci.edu/-kdd/databases/kddcup99/, 1999
14. J. R. Quinlan. C4.5: Program for Machine Learning [M]. San Francisco: Morgan Kaufmann, 1993
15. T. Joachims. Making large-scale SVM learning practical [OL]. http://www-ai.cs.uni-dortmund.de/DOKUMENTE/joachims_99a.ps.gz, 1999