Detection and classification of anomaly intrusion using hierarchy clustering and SVM. Issue 16 (7th July 2016)

• Record Type: Journal Article
• Authors: Tang, Chenghua; Xiang, Yang; Wang, Yu; Qian, Junyan; Qiang, Baohua
• Is Part Of: Security and communication networks. Volume 9:Issue 16(2016)
• Page Start: 3401
• Page End: 3411
• Publication Date: 2016-07-07
• Subjects: anomaly intrusion detection -- fuzzy c‐means clustering -- membership function -- support vector machine; Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1547
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract: Anomaly detection as a kind of intrusion detection is good at detecting the unknown attacks or new attacks, and it has attracted much attention during recent years. In this paper, a new hierarchy anomaly intrusion detection model that combines the fuzzy c ‐means (FCM) based on genetic algorithm and SVM is proposed. During the process of detecting intrusion, the membership function and the fuzzy interval are applied to it, and the process is extended to soft classification from the previous hard classification. Then a fuzzy error correction sub interval is introduced, so when the detection result of a data instance belongs to this range, the data will be re‐detected in order to improve the effectiveness of intrusion detection. Experimental results show that the proposed model can effectively detect the vast majority of network attack types, which provides a feasible solution for solving the problems of false alarm rate and detection rate in anomaly intrusion detection model. Copyright © 2016 John Wiley & Sons, Ltd. Abstract : A hierarchy anomaly intrusion detection model (GAFCM) that combines the Fuzzy c‐means based on genetic algorithm and SVM is proposed. The process with the membership function is extended to soft classification. Based on the fuzzy error correction sub interval, the data will be re‐detected to improve the detection effectiveness, and it can detect the vast majority of network attack types.