5800 Y. Yu et al.
used for validation (i.e., evaluating how many false positives are produced by base
classifiers over the validation set).
The second contribution is that extreme learning machine (ELM) algorithm is used
to train base classifiers such that nonlinear boundaries between classes can be delin-
eated. ELM [10] is a learning algorithm for a single-hidden-layer feedforward neural
network (SFNN). The first advantage of the ELM algorithm is that the input weights
between the input and the hidden layers are randomly assigned. That is, the connection
between the input and hidden layers realizes a random feature mapping. Since only
the output weights between the hidden and the output layers are trained, layer-by-
layer back-propagated tuning is not required so as to ease the global optimization. The
second advantage of ELM is the improved generalization, in that the norm of output
weights is included in the cost function. Based on these two advantages, the ELM algo-
rithm can theoretically obtain a global optimal and generalized solution for multi-class
recognition compared against SVM-based one-to-all strategy and BP neural network.
The third contribution is that ELM algorithm can reduce the computational cost
of training due to its random assignment of input weights. As there is only one hid-
den layer, the computational cost of recognition process is also low. Thus, the ELM
algorithm can obtain a good balance between recognition accuracy and computational
efficiency.
The KDD99 dataset [1] which consists of 5 million network connection records
is used to evaluate this proposed NID method. Furthermore, this proposed method is
compared against decision tree, BP neural network and SVM-based methods.
The remainder of this paper is organized as follows. Section 2 reviews the related
work of NID. Section 3 presents the detailed implementation of this proposed method.
Section 4 shows the experimental results.
2 Related work
2.1 Review of NID methods
NID systems can be classified as either host based or network based. Host-based
systems prevent the execution of codes in a single computer, while network-based
systems examine the network traffic [6]. Existing NID methods can be categorized
as anomaly detection based and multi-class identification based. Anomaly detection
methods are designed to detect abnormal patterns under the condition that normal
network behavior patterns are known. The most important issue of such methods is how
to design a task-independent anomaly detection algorithm even in the condition that the
given normal patterns are sufficient, accurate and extensive. Multi-class identification
methods aim to train a classifier given normal and intrusion patterns and then the
trained classifier can be used to determine whether a network behavior is an intrusion
or not. Thus, such type of methods can achieve l ower false alert rate. It is important
to note that two categories are both based on machine learning techniques. Network
behavior data can be obtained from log files or system calls.
There are mainly three types of multi-class identification methods used for NID. The
first one is decision tree. One challenging issue of decision tree-based methods is the
123
剩余15页未读，继续阅读
weixin_38709466
- 粉丝: 5
- 资源: 969
我的内容管理
展开
最新资源
- 多模态联合稀疏表示在视频目标跟踪中的应用
- Kubernetes资源管控与Gardener开源软件实践解析
- MPI集群监控与负载平衡策略
- 自动化PHP安全漏洞检测：静态代码分析与数据流方法
- 青苔数据CEO程永：技术生态与阿里云开放创新
- 制造业转型： HyperX引领企业上云策略
- 赵维五分享：航空工业电子采购上云实战与运维策略
- 单片机控制的LED点阵显示屏设计及其实现
- 驻云科技李俊涛：AI驱动的云上服务新趋势与挑战
- 6LoWPAN物联网边界路由器：设计与实现
- 猩便利工程师仲小玉：Terraform云资源管理最佳实践与团队协作
- 类差分度改进的互信息特征选择提升文本分类性能
- VERITAS与阿里云合作的混合云转型与数据保护方案
- 云制造中的生产线仿真模型设计与虚拟化研究
- 汪洋在PostgresChina2018分享：高可用 PostgreSQL 工具与架构设计
- 2018 PostgresChina大会：阿里云时空引擎Ganos在PostgreSQL中的创新应用与多模型存储
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
