Network surveillance and multi-group intrusion classification
Gang Kou, Nian Yan, Yi Peng, Yong Shi, Zhengxin Chen · 2005
The early and reliable detection of malicious attacks is a crucial issue for today's network security and survivability. Different types of attacks may need different responses. Therefore, it is a meaningful task to predict the category of malicious attacks and take appropriate reactions. The goal of this paper is to apply multiple-criteria linear programming (MCLP) method to the multi-group intrusion classification problem. Specifically, we first collect a multi-group network intrusion dataset using Tenable NeWT Security Scanner. Five attack types and total of 9061 data records were captured. After that, MCLP five-group model was applied to the NeWT dataset. The classification accuracy of MCLP was compared with see5, a decision-tree-based classification tool. The experimental results of this research indicate that MCLP achieves comparable classification accuracy to see5.