Fuzziness based semi-supervised learning approach for intrusion detection system

详细信息    查看全文

• 作者：Rana Aamir Raza Ashfaq^a ; ^{aamir@szu.edu.cn" class="auth_mail" title="E-mail the corresponding author} ; Xi-Zhao Wang ; ^a ; ^{xizhaowang@ieee.org" class="auth_mail" title="E-mail the corresponding author} ; ^{xwang@szu.edu.cn" class="auth_mail" title="E-mail the corresponding author} ; Joshua Zhexue Huang^a ; ^{zx.huang@szu.edu.cn" class="auth_mail" title="E-mail the corresponding author} ; Haider Abbas^b ; ^{hsiddiqui@ksu.edu.sa" class="auth_mail" title="E-mail the corresponding author} ; Yu-Lin He^a ; ^{yulinhe@szu.edu.cn" class="auth_mail" title="E-mail the corresponding author}
• 关键词：Fuzziness ; Divide-and-conquer strategy ; Semi-supervised learning ; Intrusion detection ; Random weight neural network
• 刊名：Information Sciences
• 出版年：2017
• 出版时间：1 February 2017
• 年：2017
• 卷：378
• 期：Complete
• 页码：484-497
• 全文大小：1689 K

文摘

Countering cyber threats, especially attack detection, is a challenging area of research in the field of information assurance. Intruders use polymorphic mechanisms to masquerade the attack payload and evade the detection techniques. Many supervised and unsupervised learning approaches from the field of machine learning and pattern recognition have been used to increase the efficacy of intrusion detection systems (IDSs). Supervised learning approaches use only labeled samples to train a classifier, but obtaining sufficient labeled samples is cumbersome, and requires the efforts of domain experts. However, unlabeled samples can easily be obtained in many real world problems. Compared to supervised learning approaches, semi-supervised learning (SSL) addresses this issue by considering large amount of unlabeled samples together with the labeled samples to build a better classifier. This paper proposes a novel fuzziness based semi-supervised learning approach by utilizing unlabeled samples assisted with supervised learning algorithm to improve the classifier’s performance for the IDSs. A single hidden layer feed-forward neural network (SLFN) is trained to output a fuzzy membership vector, and the sample categorization (low, mid, and high fuzziness categories) on unlabeled samples is performed using the fuzzy quantity. The classifier is retrained after incorporating each category separately into the original training set. The experimental results using this technique of intrusion detection on the NSL-KDD dataset show that unlabeled samples belonging to low and high fuzziness groups make major contributions to improve the classifier’s performance compared to existing classifiers e.g., naive bayes, support vector machine, random forests, etc.