Adaptive Anomaly Intrusion Detection System Using Optimized Hoeffding Tree and Adaptive Drift Detection Method
S. Ranjitha Kumari, Panchamy Krishnakumari, Rathnavel Subramaniam · 2014
In the real time Intrusion Detection system, the main confront is to detect the new attacks rapidly and update the underlying intrusion detection immediately. The data are dynamic in nature in the real time environment and the data evolve over the time gradually or abruptly. This has decreased the performance of the Intrusion Detection system in terms low accuracy rate and high false alarm rate. In order to overcome these pitfalls, we have proposed an Adaptive Anomaly Intrusion Detection system using Optimized Hoeffding Tree and Adaptive Drift Detection method. The proposed model identifies the new attack immediately, identifies changes in the data over time, updates the underlying model and predicts the attacks with high accuracy rate and low false alarm rate. We have used Optimized Hoeffding Tree where the node splitting is controlled using error rate. The concept drift in the evolving data is identified using Adaptive Drift Detection method which uses probability of error rate (Misclassification rate as well as False Alarm Rate) from the Optimized Hoeffding Tree. The use of probability of Misclassification rate as well as False Alarm Rate in identifying the drift has increased the accuracy rate and reduced the false alarm rate of our model. We have compared the results of our Adaptive Anomaly Intrusion Detection system Model with ADWIN change Detector, Page Hinkley Test and EWMA (Exponentially Weighted Moving Average) Control chart detection method using NSL-KDD Dataset. Our model performed better than other models in terms of Accuracy and Low False Alarm Rate in dynamic environment.