An Adaptive Feedback Mechanism Algorithm for Intrusion Detection System
Shan-Tai Chen, Chih-Chen Pan, Chyi-Bao Yang · 2009
Machine learning technologies to network Intrusion Detection System (IDS) have become an important research direction these years. However, there are still some shortages for the current IDS technologies, such as low accuracy, high false alarm rate, and especially the low recall problem from imbalanced datasets. In this paper, we propose an Adaptive Feedback Mechanism Algorithm (AFMA) to enhance network based intrusion detection for imbalanced datasets. Avoiding a bias towards the majority class(es) in a data set, AFMA can significantly improve recall of a given important-and- minor(MAI) class whilst maintaining the overall accuracy. Cooperating with any supervised learning algorithm, AFMA can resolve the low recall problem resulted from imbalanced datasets. We use five machine learning algorithms, including Neural Network, SVM, CHAID, Random Forest, and Decision Tree, to verify the robustness of AFMA. Experimental results show that enhanced with AFMA, all the five algorithms can significantly improve the low recall problem form the KDD-Cup99 dataset. In addition, enhanced with AFMA, decision tree learning algorithm outperforms other published intrusion detection technologies in terms of G-Mean, Cost, and overall accuracy for classifying intrusion events in the dataset.