—Intrusion detection is an important task for network operators in today’s Internet. Traditional network intrusion detection systems rely on either specialized signatures of previously seen attacks, or on labeled traffic datasets that are expensive and difficult to re-produce for user-profiling to hunt out network attacks. This paper presents a feature grouping method for the selection of feat...

Huge datasets in cyber security, such as network traffic logs, can be analyzed using machine learning and data mining methods. However, the amount of collected data is increasing, which makes analysis more difficult. Many machine learning methods have not been designed for big datasets, and consequently are slow and difficult to understand. We address the issue of efficient network traffic clas...

In this study, I evaluate the performance of diagonal Confidence-Weighted (CW) online linear classification on the KDD Cup 1999 dataset for network intrusion detection systems (NIDS). This is a compatible relationship due to the large number of instances in NIDS datasets, as well as the constantly changing feature distributions. CW learning achieves approximately 92% accuracy on the KDD dataset...

Traditional intrusion detection techniques examine all features to detect intrusion or misuse patterns. But all features are not relevant and some of them may be redundant and contribute little to the detection process. Irrelevant and redundant features may lead to complex intrusion detection model as well as poor detection accuracy. In this paper, we propose and investigate a novel hybrid feat...

The paper describes a new approach of classification using genetic programming. The proposed technique consists of genetically coevolving a population of non-linear transformations on the input data to be classified, and map them to a new space with a reduced dimension, in order to get maximum inter-classes discrimination. The classification of new samples is then performed on the transformed d...

Network traffic have several attributes with different range of values. These attributes can be qualitative or quantitative in nature. Attributes with large values significantly influence the performance of intrusion classifier making it bias towards them. Attribute normalization eliminates such dominance of the attributes by scaling the values of all the attributes within a specific range. The...

Computer networks have expanded significantly in use and this makes them more vulnerable to attacks. It is really important to secure the data from any intrusive attacks so intrusion detection is really very helpful in the field of computer network security. Intrusion detection is the act of detecting unwanted traffic on a network. Many current intrusion detection systems are unable to find unk...

Network intrusion detection is the problem of detecting anomalous network connections caused by intrusive activities. Many intrusion detection systems proposed before use both normal and intrusion data to build their classifiers. However, intrusion data are usually scarce and difficult to collect. We propose to solve this problem using a novelty detection approach. In particular, we propose to ...

Intrusion detection is an essential mechanism to protect computer systems from many attacks. Clustering is the most acceptable technique to regroup the raw data into clusters but it cannot identify them. In this paper, we present a technique for the identification of unknown TCP connections using K-mean WEKA-based. Specifically, we built mixture models using KDD cup 99 and our traffic traces ca...