Emna Bahri

Approach based ensemble methods for better and faster intrusion detection

This study introduces a new method based on Greedy-Boost, a multiple classifier system, for better and faster intrusion detection. Detection of the anomalies in the data-processing networks is regarded as a problem of data classification allowing to use data mining and machine learning techniques to perform intrusion detection. With such automatic processing procedures, human expertise only focuses on a small set of potential anomalies which may result in important time savings and efficiency. In order to be scalable and efficient, these kinds of approaches must respect important requirements. The first is to obtain a high level of precision, that is to be able to detect a maximum of anomalies with a minimum of false alarms. The second is to detect potential anomalies as fast as possible. We propose Greedy-Boost, a new approach of boosting which is based on an adaptive combination of multiple classifiers to perform the precision of the detection. This approach uses an aspect of smooth that ensures stability of the classifier system and offers speed of detection. The experimental results, conducted on the KDD99 dataset, prove that our proposed approach outperforms several state-of-the-art methods, particularly in detecting rare attack types.

Improving Prediction by Weighting Class Association Rules

Associative classification presents various methods whose common characteristic is the class prediction from the class association rules (rules whose consequent one is one of the class modalities). According to [11] and [10], this new approach offers better results than the traditional approaches based on rules such as the decision trees. It also offers a great flexibility with the unstructured data. However, this approach suffers from a huge mass of generated rules which leads to a waste of time and space. In this work, we propose a new associative classification method. This method is based on FCP-Growth-P, an algorithm which generates only class itemsets and integrates for pruning the specialization condition of Li. Thus one saves both execution time and storage space. The phase of classification is based on a reduced base of the most significant rules leading to each class, which ensures the speed of the method. Examples are classified using the results given by the vote of these various rules weighted by its quality measure.

Real detection intrusion using supervised and unsupervised learning

Advances in software and networking technologies have nowadays brought about innumerable benefits to both individuals and organizations. Along with technological explosions, there ironically exist numerous potential cyber-security breaches, thus advocating attackers to devise hazardous intrusion tactics against vulnerable information systems. Such security-related concerns have motivated many researchers to propose various solutions to face the continuous growth of cyber threats during the past decade. Among many existing IDS methodologies, data mining has brought a remarkable success in intrusion detection. However, data mining approaches for intrusion detection have still confronted numerous challenges ranging from data collecting and feature processing to the appropriate choice of learning methods and parametric thresholds. Hence, designing efficient IDSs remains very tough. In this paper, we propose a new intrusion detection system by combining unsupervised and supervised learning method. Results shows the performance of this system.

A Hybrid Approach of Boosting Against Noisy Data

To reduce error in generalization, a great number of work is carried out on the classifiers aggregation methods in order to improve generally, by voting techniques, the performance of a single classifier. Among these methods of aggregation, we find the Boosting which is most practical thanks to the adaptive update of the distribution of the examples aiming at increasing in an exponential way the weight of the badly classified examples. However, this method is blamed because of overfitting, and the convergence speed especially with noise. In this study, we propose a new approach and modifications carried out on the algorithm of AdaBoost. We will demonstrate that it is possible to improve the performance of the Boosting, by exploiting assumptions generated with the former iterations to correct the weights of the examples. An experimental study shows the interest of this new approach, called hybrid approach.

Improving boosting by exploiting former assumptions

The error reduction in generalization is one of the principal motivations of research in machine learning. Thus, a great number of work is carried out on the classifiers aggregation methods in order to improve generally, by voting techniques, the performance of a single classifier. Among these methods of aggregation, we find the Boosting which is most practical thanks to the adaptive update of the distribution of the examples aiming at increasing in an exponential way the weight of the badly classified examples. However, this method is blamed because of overfitting, and the convergence speed especially with noise. In this study, we propose a new approach and modifications carried out on the algorithm of AdaBoost. We will demonstrate that it is possible to improve the performance of the Boosting, by exploiting assumptions generated with the former iterations to correct the weights of the examples. An experimental study shows the interest of this new approach, called hybrid approach.