Informatics Publishing Limited

T. Subbulakshmi ¹, S. Mercy Shalinie ¹, A. Ramamoorthi ¹

Affiliations
1 Department of Computer Science and Engineering, Thiagarajar College of Engineering, Tamil Nadu, IN

Abstract

Masqueraders are a category of intruders who impersonate other people on a computer system and use this entry point to use the information stored in the systems or throw other attacks into the network. This paper focuses on Ensemble Design of a Masquerader Detection System using Decision trees and Support Vector Machines for classification with two kernel functions linear and linear BSpline. The key idea is to find out specific patterns of command sequence that tells about user behaviour on a system, and use them to build classifiers that can perfectly recognize anomalous and normal behaviour. Real time truncated command line data set collected from a debian Linux server is used for performance comparison of the developed classifiers with the standard truncated command line data set of Schonlau[4]. The results show that Ensemble Design of Masquerader Detection Systems is much faster than individual Decision trees or Support Vector Machines.

Keywords

Masquerader Detection, Support Vector Machines, Decision Trees, Truncated Command Sequences.

Full Text

     

T. Subbulakshmi ¹, A. Ramamoorthi ², S. Mercy Shalinie ¹

Affiliations
1 Department of Computer Science and Engineering, Thiagarajar College of Engineering, Madurai, IN
2 Computer Science Department, Sethu Institute of Technology, Madurai, IN

Abstract

Intrusion Detection problem is one of the most promising research issues of Information Security. The problem provides excellent opportunities in terms of providing host and network security. Intrusion detection is divided into two categories with respect to the type of detection. Misuse detection and Anomaly detection. Intrusion detection is done using rule based, Statistical, and Soft computing techniques. The rule based measures provides better results but the extensibility of the approach is still a question. The statistical measures are lagging in identifying the new types of attacks. Soft Computing Techniques offers good results since learning is done using the training, and during testing the new pattern of attacks was also recognized appreciably. This paper aims at detecting Intruders using both Misuse and Anomaly detection by applying Ensemble of soft Computing Techniques. Neural networks, Support Vector Machines and Naïve Bayes Classifiers are trained and tested individually and the classification rates for different classes are observed. Then threshold values are set for all the classes. Based on this threshold value the ensemble approach produces result for various classes. The standard kddcup'99 dataset is used in this research for Misuse detection. Shonlau dataset of truncated UNIX commands is used for Anomaly detection. The detection rate and false alarm rates are notified. Multilayer Perceptrons, Naïve Bayes classifiers and Support vector machines with three kernel functions are used for detecting intruders. The Precision, Recall and F- Measure for all the techniques are calculated. The cost of the techniques is estimated using the cost measures. The Receiver Operating Characteristic (ROC) curves are drawn for all the techniques. The results show that Support Vector Machines and Ensemble approach provides better detection rate of 99% than the other algorithms.

Keywords

Intrusion Detection Systems, Anomaly Detection Systems, Misuse Detection Systems, Support Vector Machines, Naive Bayes Classifiers, Multilayer Perceptrons, Ensemble Approach.

Full Text