Classification Algorithms in Comparing Classifier Categories to Predict the Accuracy of the Network Intrusion Detection - A Machine Learning Approach

摘要

In the era of information society, computer networks and their related applications are the emerging technologies. Network Intrusion Detection aims in distinguishing the behavior of the network. As the network attacks have increased in huge numbers over the past few years, Intrusion Detection System (IDS) is increasingly becoming a necessary component to secure the network. Due to large volumes of security audit data as well as complex and dynamic properties of intrusion behaviors, optimizing performance of IDS becomes an important open problem that is receiving more and more attention from the research community. In this paper, we evaluate the performance of a set of Classifier Algorithms of Rules (JRIP, Decision Table, PART, and OneR) and Trees (J48 Random Forest, REP Tree NB Tree), Lazy (IB1, IBK, Kstar), Functions (MLP, SMO, RBF), Bayes (Naive Bayes Updateable, Bayesnet, NaiveBayes). The empirical simulation result shows the comparison between the noticeable performance improvements. This paper presents the implementation in WEKA environment. The classification models were trained using the data collected from Knowledge Discovery Databases (KDD) for Intrusion Detection. The trained models were then used for predicting the risk of the attacks in a web server environment or by any network administrator or any Security Experts. The Prediction Accuracy of the Classifiers was evaluated using 10-fold Cross Validation and the results have been compared to obtain the best Prediction Accuracy. The results indicate that the C4.5 decision tree Classifier trees.J48 outperforms in prediction than the other categories Rules, Lazy, Functions, Bayes Classifier, and the Computational Performance differs significantly. As the nature of the application demands more accurate prediction than the learning time, it is suggested that the C4.5 the Decision Tree Classifier may be practically used by the Network Security Professional or the Administrators to assess the risk of the attacks.