Authors : Kyung-Hwan Cha and Dae-Ki Kang
Abstract: In intrusion detection systems based on machine learning techniques, most research work prefer N-gram based approaches. There has been insufficient investigation on the application of N-gram based methodologies to intrusion detection. In this study, we consider applying conditional random field method to misuse intrusion detection problems. In order to evaluate the performance of our proposed system, we compare our proposal with Naive Bayes algorithm and support vector machines on host based misuse intrusion detection benchmark datasets. Public host based misuse intrusion detection benchmark datasets are from University of New Mexico. The experimental results on the benchmark datasets such as UNM indicate that CRF generates accurate misuse intrusion detector with comparable performance to support vector machines and Naive Bayes. CRF produces intrusion detection programs with higher or comparable accuracy than the intrusion detectors produced from Naive Bayes with N-gram features. And intrusion detectors generated from CRF exhibits comparable accuracy to the intrusion detectors produced from N-gram featured SVM. For the “denial of service” data, CRF show the highest performance over other algorithms. The experimental results and their analysis have shown that CRF with N-gram will provide comparable prediction accuracy to practical cutting edge machine learning algorithms and will be useful as a component of actual misuse intrusion detectors.
Kyung-Hwan Cha and Dae-Ki Kang, 2017. Empirical Analysis of Effective Misuse Intrusion Detection by Trace Classification using Conditional Random Fields. Journal of Engineering and Applied Sciences, 12: 6514-6518.