The practice on using machine learning for network anomaly intrusion detection

• Published in: 2011 International Conference on Machine Learning and Cybernetics Vol. 2; pp. 576 - 581
• Main Author: Yu-Xin Meng
• Format: Conference Proceeding
• Language: English; Japanese
• Published: IEEE 01.07.2011
• Subjects: Accuracy; Classification algorithms; Decision tree; Decision trees; Intrusion detection; Machine learning; Neural network; Support vector machine; Support vector machines; Training
• ISBN: 9781457703058; 145770305X
• ISSN: 2160-133X
• DOI: 10.1109/ICMLC.2011.6016798

Machine learning is regarded as an effective tool utilized by intrusion detection system (IDS) to detect abnormal activities from network traffic. In particular, neural networks, support vector machines (SVM) and decision trees are three significant and popular schemes borrowed from the machine learning community into intrusion detection in recent academic research. However, these machine learning schemes are rarely employed in large-scale practical settings. In this paper, we implement and compare machine learning schemes of neural networks, SVM and decision trees in a uniform environment with the purpose of exploring the practice and issues of using these approaches in detecting abnormal behaviors. With the analysis of experimental results, we claim that the real performance of machine learning algorithms depends heavily on practical context. Therefore, the machine learning approaches are supposed to be applied in an appropriate way in terms of the actual settings.