category-based intrusion detection using pca使用pca category-based入侵检测.pdfVIP

Journal of Information Security, 2012, 3, 259-271 /10.4236/jis.2012.34033 Published Online October 2012 (http://www.SciRP.org/journal/jis) Category-Based Intrusion Detection Using PCA 1 2 Gholam Reza Zargar , Tania Baghaie 1GIS Department, Khuzestan Electrical Power Distributed Company, Ahvaz, Iran 2Training Center of Applied Science and Technology, Tehran Municipality Information and Communication Technology Organization, Tehran, Iran Email: zargar@vu.iust.ac.ir, baghaie@vu.iust.ac.ir Received June 16, 2011; revised August 22, 2012; accepted September 5, 2012 ABSTRACT Existing Intrusion Detection Systems (IDS) examine all the network features to detect intrusion or misuse patterns. In feature-based intrusion detection, some selected features may found to be redundant, useless or less important than the rest. This paper proposes a category-based selection of effective parameters for intrusion detection using Principal Components Analysis (PCA). In this paper, 32 basic features from TCP/IP header, and 116 derived features from TCP dump are selected in a network traffic dataset. Attacks are categorized in four groups, Denial of Service (DoS), Remote to User attack (R2L), Remote to User attack (U2R) and Probing attack. TCP dump from DARPA 1998 dataset is used in the experiments as the selected dataset. PCA method is used to determine an optimal feature set to make the detection process faster. Experimental results show that feature reduction can improve detection rate for the category-based de- tection approach while maintaining the detection accuracy within an acceptable range. In this paper KNN classif