![](https://csdnimg.cn/release/download_crawler_static/15120163/bg4.jpg)
5800 Y. Yu et al.
used for validation (i.e., evaluating how many false positives are produced by base
classifiers over the validation set).
The second contribution is that extreme learning machine (ELM) algorithm is used
to train base classifiers such that nonlinear boundaries between classes can be delin-
eated. ELM [10] is a learning algorithm for a single-hidden-layer feedforward neural
network (SFNN). The first advantage of the ELM algorithm is that the input weights
between the input and the hidden layers are randomly assigned. That is, the connection
between the input and hidden layers realizes a random feature mapping. Since only
the output weights between the hidden and the output layers are trained, layer-by-
layer back-propagated tuning is not required so as to ease the global optimization. The
second advantage of ELM is the improved generalization, in that the norm of output
weights is included in the cost function. Based on these two advantages, the ELM algo-
rithm can theoretically obtain a global optimal and generalized solution for multi-class
recognition compared against SVM-based one-to-all strategy and BP neural network.
The third contribution is that ELM algorithm can reduce the computational cost
of training due to its random assignment of input weights. As there is only one hid-
den layer, the computational cost of recognition process is also low. Thus, the ELM
algorithm can obtain a good balance between recognition accuracy and computational
efficiency.
The KDD99 dataset [1] which consists of 5 million network connection records
is used to evaluate this proposed NID method. Furthermore, this proposed method is
compared against decision tree, BP neural network and SVM-based methods.
The remainder of this paper is organized as follows. Section 2 reviews the related
work of NID. Section 3 presents the detailed implementation of this proposed method.
Section 4 shows the experimental results.
2 Related work
2.1 Review of NID methods
NID systems can be classified as either host based or network based. Host-based
systems prevent the execution of codes in a single computer, while network-based
systems examine the network traffic [6]. Existing NID methods can be categorized
as anomaly detection based and multi-class identification based. Anomaly detection
methods are designed to detect abnormal patterns under the condition that normal
network behavior patterns are known. The most important issue of such methods is how
to design a task-independent anomaly detection algorithm even in the condition that the
given normal patterns are sufficient, accurate and extensive. Multi-class identification
methods aim to train a classifier given normal and intrusion patterns and then the
trained classifier can be used to determine whether a network behavior is an intrusion
or not. Thus, such type of methods can achieve l ower false alert rate. It is important
to note that two categories are both based on machine learning techniques. Network
behavior data can be obtained from log files or system calls.
There are mainly three types of multi-class identification methods used for NID. The
first one is decision tree. One challenging issue of decision tree-based methods is the
123