Combining Heterogeneous Classifiers for Network Intrusion Detection

  • Ali Borji
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4846)


Extensive use of computer networks and online electronic data and high demand for security has called for reliable intrusion detection systems. A repertoire of different classifiers has been proposed for this problem over last decade. In this paper we propose a combining classification approach for intrusion detection. Outputs of four base classifiers ANN, SVM, kNN and decision trees are fused using three combination strategies: majority voting, Bayesian averaging and a belief measure. Our results support the superiority of the proposed approach compared with single classifiers for the problem of intrusion detection.


Intrusion Detection Combined Classifiers PCA Misuse Detection Anomaly Detection 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Roesch, M.: Snort: Lightweight intrusion detection for networks. In: Proceedings of the 13th Conference on Systems Administration (LISA 1999), pp. 229–238 (1999)Google Scholar
  2. 2.
    Zhang, C., Jiang, J., Kamel, M.: Intrusion detection using hierarchical neural networks. Pattern Analysis and Machine Intelligence Research Group, Department of Electrical and Computer Engineering, University of Waterloo, Canada (2004) Google Scholar
  3. 3.
    Wun-Hua, C., Sheng-Hsun, H., Hwang-Pin, S.: Application of SVM and ANN for intrusion detection. Comput. Oper. Res. 32(10), 2617–2634 (2005)CrossRefGoogle Scholar
  4. 4.
    Lazarevic, A., Ertoz, L., Kumar, V., Ozgur, A., Srivastava, J.: A comparative study of anomaly detection schemes in network intrusion detection. In: Proceedings of the Third SIAM Conference on Data Mining (2003) Google Scholar
  5. 5.
    Pavel, L., Patrick, D., Christin, S., Rieck, K.: Learning Intrusion Detection: Supervised or Unsupervised. In: Roli, F., Vitulano, S. (eds.) ICIAP 2005. LNCS, vol. 3617, pp. 50–57. Springer, Heidelberg (2005)Google Scholar
  6. 6.
    Gómez, J., González, F., Dasgupta, D.: An immuno-fuzzy approach to anomaly detection. Fuzzy Systems. In: FUZZ 2003. 12th IEEE International Conference on Fuzzy Systems, vol. 2, pp. 1219–1224 (2003)Google Scholar
  7. 7.
    Yao, J., Zhao, S., Saxton, L.: A study on fuzzy intrusion detection. Data Mining, Intrusion Detection, Information Assurance, and Data Networks Security 2005. In: Dasarathy, B.V.(ed.) Proceedings of the SPIE, vol. 5812, pp.23–30 (2005)Google Scholar
  8. 8.
    Oja.: Principal components, minor components, and linear neural networks. Neural Networks 5(6), 927–935 (1972)CrossRefGoogle Scholar
  9. 9.
    Kuchimanchi, G.K., Phoha, V.V., Balagami, K.S., Gaddam, S.R.: Dimension reduction using feature extraction methods for Real-time misuse detection systems. In: Proceedings of the 2004 IEEE Workshop on Information Assurance and Security, West Point, NY, pp. 195–202 (2004)Google Scholar
  10. 10.
    Labib, K., Vemuri, V.R.: Detecting and visualizing denial-of-service and network probe attacks using principal component analysis. In: Third Conference on Security and Network Architectures, La Londe, France (2004)Google Scholar
  11. 11.
    Mukkamala, S., Sung, A.H., Abraham, A.: Intrusion Detection Using Ensemble of Soft Computing Paradigms. Journal of Network and Computer Applications 28, 167–182 (2005)CrossRefGoogle Scholar
  12. 12.
    Didaci, L., Giacinto, G., Roli, F.: Ensemble Learning for Intrusion Detection in Computer Networks. In: Workshop su apprendimento automatico: metodi ed applicazioni (2006)Google Scholar
  13. 13.
    Xu, L., Krzyzak, A., Suen, C.Y.: Methods for combining multiple classifiers and their applications to handwriting recognition. IEEE Trans. Systems, Man and Cybernetics 22, 418–435 (1992)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2007

Authors and Affiliations

  • Ali Borji
    • 1
  1. 1.School of Cognitive Sciences, Institute for Studies in Theoretical Physics and Mathematics, Niavaran Bldg. P.O.Box 19395-5746, TehranIran

Personalised recommendations