Research on Hybrid Intrusion Detection System Based on Random Forest Algorithm
Yanping Chen · Journal of Xi'an University of Arts and Science · 2013
The misuse detection mode of intrusion detection systems has been widely adopted and yet it has proven to be ineffective in detecting new attacks.The resulting higher detection rate has the defect of higher false alarm rate.As a result,the true attacks are often missed in the great number of false alarms.Based on a research of the error detection and anomaly detection and with a consideration of their advantages,we have proposed a hybrid intrusion detection system based on random forest algorithm.First,most of familiar attacks are filtered with Snort-based misuse detection components.Then,the data filtered were sent to the anomaly detection components,in which,through the improvement of random forest algorithm,an unsupervised outlier detection method was designed.The suggested method is effective in detecting new attacks.Even when false alarm rate is low,the detection rate proves to be high.