A Sequential Classifiers Combination Method to Reduce False Negative for Intrusion Detection System
A Sequential Classifiers Combination Method to Reduce False Negative for Intrusion Detection System
复制标题
减少入侵检测系统误报的顺序分类器组合方法
DOI：
10.1587/transinf.2018ntp0019
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Toshihito Kato
中科院分区：
文献类型：
--
作者：
Sornxayya Phetlasy;S. Ohzahata;Celimuge Wu;Toshihito Kato
入侵检测系统（IDS）是一种用于监视网络系统中恶意活动的设备或软件。就检测结果而言，可能存在两种类型的错误，即，错误地将正常传输检测为异常的假阳性（FP），以及错误地将恶意传输判断为正常的假阴性（FN）。为了保护网络系统，我们期望FN应该尽可能地最小化。然而，由于当IDS检测到恶意攻击时，在FP和FN之间存在权衡，因此很难同时降低这两个度量。在本文中，我们提出了一种顺序分类器组合方法，以减少贸易的影响。单个分类器通常支持较高的FN率，因此顺序组合额外的分类器以检测更多的阳性（减少更多的FN）。由于每个分类器都可以减少FN，并且在我们的方法中不会产生太多的FP，因此我们可以在最终输出中实现FN的减少。在评估中，我们使用NSL-KDD数据集，这是KDD Cup'99数据集的更新版本。实验结果表明，该方法在降低FN的同时，提高了分类的灵敏度和准确度。
SUMMARY Intrusion detection system (IDS) is a device or software to monitor a network system for malicious activity. In terms of detection results, there could be two types of false, namely, the false positive (FP) which incorrectly detects normal tra ffi c as abnormal, and the false negative (FN) which incorrectly judges malicious tra ffi c as normal. To protect the network system, we expect that FN should be minimized as low as possible. However, since there is a trade-o ff between FP and FN when IDS detects malicious tra ffi c, it is di ffi cult to reduce the both metrics simultaneously. In this paper, we propose a sequential classifiers combination method to reduce the e ff ect of the trade-o ff . The single classifier su ff ers a high FN rate in general, therefore additional classifiers are sequentially combined in order to detect more positives (reduce more FN). Since each classifier can reduce FN and does not generate much FP in our approach, we can achieve a reduction of FN at the final output. In evaluations, we use NSL-KDD dataset, which is an updated version of KDD Cup’99 dataset. WEKA is utilized as a classification tool in experiment, and the results show that the proposed approach can reduce FN while improving the sensitivity and accuracy.