Layered Architecture to Detect Attacks Using Asymmetric Support Vector Machine
J. Jensi Edith, A. Chandrasekar · Journal of Applied Security Research · 2014
Intrusion detection is one of the most interesting tasks for network administrators. There is a necessity in protecting the networks from known liabilities by developing more consistent and efficient intrusion detection systems. A distributed intrusion detection system (IDS) is proposed to find the different types of attacks in the networks. Methods such as naïve Bayes assume independence among the observed data. This increases system efficiency but may badly affect the accuracy. To balance this tradeoff, we use asymmetric support vector machines (ASVM) that are more accurate Though it is expensive, we implement the layered approach to improve overall system performance. ASVM is an asymmetric extension of a support vector machine (SVM). The main aim is to reduce the false positive rate while detecting the attacks. The layers are denial of service (DOS) layer, probe layer, remote to local (R2L) layer and user to root (U2R) layer. The layers are used to find the attacks corresponding to that layer.