Performance Analysis on Competitive, Roulette Wheel and Pseudo-Random Rules for Intrusion Detection
Ruey‐Maw Chen · Applied Mathematics & Information Sciences · 2013
Intrusion detection is a critical component of network security; detection s chemes fundamentally use the observed characteristics of network packets as a basis for such determinations. Meanwhile, intrusion detection can be regarded as a clustering problem; many clustering schemes have been applied for classifying network packets. Among them, back propagation networks (BPN) and fuzzy c-means (FCM) are popular and well applied. Both of these schemes are based on a competitive characteristic. Nevertheless, a competitive characteristic may cause impropriate clustering results for in trusion detection. Hence, in this study, different clustering criteria are proposed and adopted in BPN and FCM for classifying intrusion packet type; they are the roulette wheel selection rule and pseudo-random rule. Moreover, KDDCUP99 data sets were used as the evaluation packet samples of the experiments, and the given 41 packet features are reduced to 9, 11 and 24 key features for experimentation. Simulation results demonstrate that the proposed intrusion detection criteria applied in BPN yields higher detection rates for the U 2R and R2L connections; misclassification of U2R and R2L connections would allow greater damage. Additionally, the suggested roulette wheel selection rule and pseudo-random rule intrusion detection criteria integrated into BPN are superior to other schemes with only 11 features used further reducing complexity and computation time.