Using Rough Set and Support Vector Machine for Network Intrusion Detection

Abstract: The main function of IDS (Intrusion Detection System) is to protect the system, analyze and predict the behaviors of users. Then these behaviors will be considered an attack or a normal behavior. Though IDS has been developed for many years, the large number of return alert messages makes managers maintain system inefficiently. In this paper, we use RST (Rough Set Theory) and SVM (Support Vector Machine) to detect intrusions. First, RST is used to preprocess the data and reduce the dimensions. Next, the features were selected by RST will be sent to SVM model to learn and test respectively. The method is effective to decrease the space density of data. The experiments will compare the results with different methods and show RST and SVM schema could improve the false positive rate and accuracy.

Overview of Rough Set and Support Vector Machine for Network Intrusion Detection

The paper "Using Rough Set and Support Vector Machine for Network Intrusion Detection" presents a methodological approach to enhancing network intrusion detection systems (IDS) through the synergy of Rough Set Theory (RST) and Support Vector Machine (SVM). This study aims to advance IDS efficacy by addressing two main challenges: the reduction of false positives and the improvement of attack detection rates.

Methodology

The research proposes a multi-step framework for intrusion detection that capitalizes on the dimensionality reduction capabilities of RST and the classification power of SVM. Initially, RST is deployed to preprocess and diminish data attributes, thereby reducing the dataset's space density. The processed data is subsequently fed into an SVM classifier, which is tasked with distinguishing between normal and malicious network behaviors.

The paper employs the KDD Cup’99 dataset, a standard benchmark in IDS research, to validate the proposed approach. The dataset's transformation from 41 initial features to 29 features selected by RST highlights the potential for dimensionality reduction without significant loss of critical information required for accurate intrusion detection.

Experimental Results

The experimental evaluation reveals that the RST-SVM approach provides a competitive advantage over traditional methods. The researchers constructed three SVM models using different feature sets: all 41 original features, entropy-based features, and RST-reduced features. The results showed:

• Attack Detection Rate (ADR): The RST-SVM model achieved an ADR of 86.72%, which, while not as high as the entropy-based model at 92.44%, was significantly higher than the full feature set model at 70.03%.
• False Positive Rate (FPR): The RST-SVM approach had a FPR of 13.27%, superior to the entropy model (7.56%), yet showing enhancements in system precision.
• Accuracy Rate (AR): Accuracy of the RST-SVM model stood at 89.13%, demonstrating a better balance between precision and recall compared to the other two feature models.

Implications and Future Research

From a practical perspective, the combination of RST and SVM provides a robust mechanism for improving the efficiency and effectiveness of IDS. By focusing on feature reduction through RST, the methodology reduces computational overhead, making it suitable for real-time application in network security tasks. Theoretical implications include the validation of rough set and support vector techniques in machine learning-driven IDS frameworks.

However, this study's approach reveals some limitations, notably the trade-offs between ADR and FPR metrics. As an avenue for future research, the authors suggest the exploration of hybrid models integrating genetic algorithms alongside RST to optimize feature selection further and potentially address current drawbacks. Such integration could refine intrusion detection capabilities, contributing towards developing more adaptive and intelligent IDS systems.

In conclusion, the paper provides valuable insights into the application of rough set theory and support vector machines in network security. It establishes a solid foundation for subsequent research endeavors aiming to leverage machine learning techniques for enhancing IDS performance, which is indispensable in the backdrop of increasingly sophisticated cyber threats.