Selection of Candidate Support Vectors in incremental SVM for network intrusion detection

• Published in: Computers & security Vol. 45; pp. 231 - 241
• Main Authors: Chitrakar, Roshan, Huang, Chuanhe
• Format: Journal Article
• Language: English
• Published: Amsterdam Elsevier Ltd 01.09.2014; Elsevier; Elsevier Sequoia S.A
• Subjects: Algorithmics. Computability. Computer arithmetics; Algorithms; Applied sciences; Artificial intelligence; Candidate Support Vector; Classification; Computer information security; Computer science; control theory; systems; Data processing. List processing. Character string processing; Exact sciences and technology; Half-partition strategy; Incremental support vector machine; Intrusion; Intrusion detection systems; Karush–Kuhn–Tucker condition; Mathematical analysis; Memory and file management (including protection and security); Memory organisation. Data processing; Network intrusion detection; Optimization algorithms; Software; Strategy; Studies; Support vector machines; Theoretical computing; Vectors (mathematics); Candidate Support Vector; Karush–Kuhn–Tucker condition; Half-partition strategy; Network intrusion detection; Incremental support vector machine; Performance evaluation; Reuse; Karush-Kuhn-Tucker condition; Online algorithm; Intruder detector; Real time; Experimental result; Ring; Vector support machine; Kuhn Tucker condition; Computer security; Intrusion detection systems
• ISSN: 0167-4048; 1872-6208
• DOI: 10.1016/j.cose.2014.06.006

In an Incremental Support Vector Machine classification, the data objects labelled as non-support vectors by the previous classification are re-used as training data in the next classification along with new data samples verified by Karush–Kuhn–Tucker (KKT) condition. This paper proposes Half-partition strategy of selecting and retaining non-support vectors of the current increment of classification – named as Candidate Support Vectors (CSV) – which are likely to become support vectors in the next increment of classification. This research work also designs an algorithm named the Candidate Support Vector based Incremental SVM (CSV-ISVM) algorithm that implements the proposed strategy and materializes the whole process of incremental SVM classification. This work also suggests modifications to the previously proposed concentric-ring method and reserved set strategy. Performance of the proposed method is evaluated with experiments and also by comparing it with other ISVM techniques. Experimental results and performance analyses show that the proposed algorithm CSV-ISVM is better than general ISVM classifications for real-time network intrusion detection.