دانلود رایگان ترجمه مقاله تخمین الگوریتم بسیار سریع درخت تصمیم گیری جهت تشخیص نفوذ شبکه (نشریه Ijarcsse 2016)

تخمین الگوریتم بسیار سریع درخت تصمیم گیری جهت تشخیص نفوذ شبکه

Evaluating Very Fast Decision Tree (VFDT) Algorithm for Detecting Network Intrusion

Abstract

With recent advances in network based technology needs protecting computers and networks which becomes a huge problem. Based on information coming from various response teams a computer was attacked or broken into more than once per second. In this paper, two grains levels intrusion detection system (IDS) is suggested fine-grained and coarse-grained. In normal case the intrusions are not detected, to improve the performance the most suitable IDS level is the coarse-grained. Any intrusion is detected by coarse-grained IDS after that the fine-grained is used to detect the possible attack details. Very fast decision tree (VFDT) algorithm is used in both of these detection levels. In order to ensure efficiency of the proposed model, it has been tested on KDD CUP 99 dataset and a real traffic dataset. Experimental results demonstrate that the proposed model is highly successful in detecting known and unknown attacks

1 Introduction

An intrusion detection system (IDS) inspects all network activity and identifies suspicious patterns that may indicate a network or system attack from someone attempting to break into or compromise a system. With the rapid growth in network, intrusions in computers have increased rapidly. Intrusion Detection System is an essential component of a complete defence-in-depth architecture for network security. It collects and inspects packets, looking for evidence of intrusive behaviours. Whenever intrusive event is detected, an alarm is raised giving the security analyst an opportunity to react promptly. Most of designed IDSs cannot cope with fast networks. Although several IDS systems are available, the common objectives of these systems are to reduce the amount of false alarms, and to recognize new attacks in order to increase detection ratio. In this paper, the concentration is on detecting attacks in fast networks in order to mitigate the influence of the attack by reducing the time gap between the real attack and its detection. This paper contributes to build two grains levels IDS in order to detect abnormal behaviour of network traffic and cope with fast networks i.e. finegrained and coarse-grained. It is well known that the intrusion occurrence in networks with respect to general traffic is rare. These motivate us to build the proposed two grains levels IDS they are fine-grained and coarse-grained. In normal case, where intrusions are not detected, the most suitable IDS level is the coarse-grained to increase performance. At the moment of intrusion is detected by coarse-grained IDS, the fine-grained IDS is used to detect as most as possible of attack details.. The coarse-grained Intrusion Detection System focuses on five packet features while fine-grained Intrusion Detection System works on 20 features. Very Fast Decision Tree (VFDT) algorithm is selected as a fast classifier. The advantages of this system is processing and analysing of high-speed network traffic, discovering and accurately identifying new attacks to reduce the false alarms to an maximum extent, and detecting the intrusion in real time. DARPA KDD CUP 99 dataset is used as a bench-mark for the proposed IDS, which contains 41 features. we analysed these features and selected 20 features having information gain ratio over the average of the dataset. Then, we trained and tested the proposed system.