Presently, Network security is the most concerned subject matter because with the rapid use of internet technology and further dependence on network for keeping our data secure, it’s becoming impossible to protect from vulnerable attacks. Intrusion detection systems (IDS) are the key solution for detecting these attacks so that the network remains reliable. There are different classification approaches used to implement IDS in order to increase their efficiency in terms of detection rate. Support vector machine (SVM) is used for classification in IDS due to its good generalization ability and non linear classification using different kernel functions and performs well as compared to other classifiers. Different Kernels of SVM are used for different problems to enhance performance rate. In this paper, we provide a review of the SVM and its kernel approaches in IDS for future research and implementation towards the development of optimal approach in intrusion detection system with maximum detection rate and minimized false alarms.

A Review of Classification Approaches Using Support Vector Machine in Intrusion Detection

In this article, a comprehensive approach to information sharing framework aimed at increasing network security and survivability is presented. Currently, in order to defend complex cyber-attacks and sophisticated cybercrime, comprehensive means of ensuring network security and survivability are highly demanded. Comprehensive is understood as at least technical, human, organizational, and regulatory dimensions, whereas technical means that both on-line and off-line aspects should be carefully taken into account. The focus of this article is on the technical dimension and, in particular, on information exchange mechanisms for on-line and off-line dimension. Firstly, the on-line information exchange mechanism dedicated for interconnected federated networks is described. Then, a proposition of the off-line network information sharing approach regarding results of the risk assessment, cybersecurity audits, threat ranking, etc., is discussed. Developments and results of information sharing mechanisms in both on-line and off-line network security dimensions are also described.

Comprehensive approach to information sharing for increased network security and survivability

In this paper, a novel intrusion detection system (IDS) is developed using a cost based support vector machine (SVM). While developing an IDS, due to the imbalanced characteristics it is very difficult to differentiate the attack events from a non-attack (normal) event in any network environment. The cost based SVM facilitates to put much weight to one pattern over another ones to differentiate attack and non-attack cases with a high accuracy. The same can be applied on a multiclass attack problems by using cost factor to each ratio of different types of attacks. In this study, the cost based SVM has been applied to classify DARPA99 intrusion detection dataset. The experimental results show that the cost based SVM can outperform standard SVM while attempting to differentiate a case as either attack or non-attack (normal). Furthermore, we applied the cost based SVM with an RBF kernel to a multiclass attack problem. Experimental result achieved about 99 % detection accuracy when it was applied to detect the type of attacks as either of Normal, DOS, Probe and R2L from DARPA99 dataset.

Intrusion Detection System Based on Cost Based Support Vector Machine

Common Criteria(CC) provides only the standard for evaluating information security product or system. CC based evaluation on system auditing is considered crucial for the overall evaluation and in trouble without an effective method; however, the information system is a large-scale complex system. It includes many uncertain factors, as software, hardware, people and so on. As a result, information systems security risk is related to many ambiguous factors, what are difficult to measure, with ambiguity. In this paper, a method for system auditing based on baseline assessment was presented, In our method, analytic hierarchy process is introduced, which could be used to evaluate the security situation of information system.

A method for system auditing based on baseline assessment

With the development of internet, network is playing an increasingly important part in people's lives, but it is bringing a variety of problems, especially computer security, which has become a serious practical trouble now days. Security audit system is an essential component of computer security mechanisms underlying the firewall and intrusion detection system for computer security. Due to the fact that detection is inefficient and lacks intelligence in traditional security audit system, this paper combines Adaptive Genetic Algorithm(AGA) and Support Vector Machines(SVM) as an intelligent AGA-SVM algorithm in audit analysis, with AGA applied to optimize the penalty factor and kernel function parameters of SVM. Based on online training of AGA-SVM, a security audit system model is established and the result of the experiment shows that the method is effective and reliable.

Xiaomei Yi

Papers

Security audit system using Adaptive Genetic Algorithm and Support Vector Machine