Hybrid Intrusion Detection System Based on the Stacking Ensemble of C5 Decision Tree Classifier and One Class Support Vector Machine

• DOI: 10.3390/electronics9010173
• Publication Date: 2020-01-17T12:39:02Z
• Authors: Ansam Khraisat; Iqbal Gondal; Peter Vamplew; Joarder Kamruzzaman; Ammar Alazab
• Keywords: machine learning; Intrusion; 0202 electrical engineering, electronic engineering, information engineering; C5.0 Decision tree; Cyber analytics; data mining; 02 engineering and technology; anomaly detection; Zero-day malware; hybrid approach; Intrusion Detection System

Cyberttacks are becoming increasingly sophisticated, necessitating the efficient intrusion detection mechanisms to monitor computer resources and generate reports on anomalous or suspicious activities. Many Intrusion Detection Systems (IDSs) use a single classifier for identifying intrusions. Single IDSs unable achieve high accuracy low false alarm rates due polymorphic, metamorphic, zero-day behaviors of malware. In this paper, Hybrid IDS (HIDS) is proposed by combining C5 decision tree One Class Support Vector Machine (OC-SVM). HIDS combines strengths SIDS) Anomaly-based System (AIDS). The SIDS was developed based C5.0 Decision AIDS one-class (SVM). This framework aims identify both well-known intrusions attacks with false-alarm rates. evaluated using benchmark datasets, namely, Network Security Laboratory-Knowledge Discovery in Databases (NSL-KDD) Australian Defence Force Academy (ADFA) datasets. Studies show that performance enhanced, compared terms rate