A Literature Survey and Comprehensive Study of Intrusion Detection <s> Support vector machine based intrusion detection <s> Whenever an intrusion occurs, the security and value of a computer system is compromised. Network-based attacks make it difficult for legitimate users to access various network services by purposely occupying or sabotaging network resources and services. This can be done by sending large amounts of network traffic, exploiting well-known faults in networking services, and by overloading network hosts. Intrusion Detection attempts to detect computer attacks by examining various data records observed in processes on the network and it is split into two groups, anomaly detection systems and misuse detection systems. Anomaly detection is an attempt to search for malicious behavior that deviates from established normal patterns. Misuse detection is used to identify intrusions that match known attack scenarios. Our interest here is in anomaly detection and our proposed method is a scalable solution for detecting network-based anomalies. We use Support Vector Machines (SVM) for classification. The SVM is one of the most successful classification algorithms in the data mining area, but its long training time limits its use. This paper presents a study for enhancing the training time of SVM, specifically when dealing with large data sets, using hierarchical clustering analysis. We use the Dynamically Growing Self-Organizing Tree (DGSOT) algorithm for clustering because it has proved to overcome the drawbacks of traditional hierarchical clustering algorithms (e.g., hierarchical agglomerative clustering). Clustering analysis helps find the boundary points, which are the most qualified data points to train SVM, between two classes. We present a new approach of combination of SVM and DGSOT, which starts with an initial training set and expands it gradually using the clustering structure produced by the DGSOT algorithm. We compare our approach with the Rocchio Bundling technique and random selection in terms of accuracy loss and training time gain using a single benchmark real data set. We show that our proposed variations contribute significantly in improving the training process of SVM with high generalization accuracy and outperform the Rocchio Bundling technique. <s> BIB001 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Support vector machine based intrusion detection <s> This paper proposes an intelligent multi level classification technique for effective intrusion detection in Mobile Ad-hoc Networks. The algorithm uses a combination of a tree classifier which uses a labeled training data and an Enhanced Multiclass SVM algorithm. Moreover, an effective preprocessing technique has been proposed and implemented in this work in order to improve the detection accuracy and to reduce the processing time. From the experiments carried out in this work, it has been observed that significant improvement has been achieved in this model from the view point of both high detection rates as well as low false alarm rates. <s> BIB002 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Support vector machine based intrusion detection <s> In the past years, several support vector machines (SVM) novelty detection approaches have been applied on the network intrusion detection field. The main advantage of these approaches is that they can characterize normal traffic even when trained with datasets containing not only normal traffic but also a number of attacks. Unfortunately, these algorithms seem to be accurate only when the normal traffic vastly outnumbers the number of attacks present in the dataset. A situation which can not be always hold. This work presents an approach for autonomous labeling of normal traffic as a way of dealing with situations where class distribution does not present the imbalance required for SVM algorithms. In this case, the autonomous labeling process is made by SNORT, a misuse-based intrusion detection system. Experiments conducted on the 1998 DARPA dataset show that the use of the proposed autonomous labeling approach not only outperforms existing SVM alternatives but also, under some attack distributions, obtains improvements over SNORT itself. <s> BIB003 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> Support vector machine based intrusion detection <s> Intrusion detection is an important technique in computer and network security. A variety of intrusion detection approaches be present to resolve this severe issue but the main problem is performance. It is important to increase the detection rates and reduce false alarm rates in the area of intrusion detection. Therefore, in this research, an optimized intrusion detection mechanism using soft computing techniques is proposed to overcome performance issues. The KDD-cup dataset is used that is a benchmark for evaluating the security detection mechanisms. The Principal Component Analysis (PCA) is applied to transform the input samples into a new feature space. The selecting of an appropriate number of principal components is a critical problem. So, Genetic Algorithm (GA) is used in the optimum selection of principal components instead of using traditional method. The Support Vector Machine (SVM) is used for classification purpose. The performance of this approach is addresses. Further, a comparative analysis is made with existing approaches. Consequently, this method provides optimal intrusion detection mechanism which is capable to minimize amount of features and maximize the detection rates. <s> BIB004
A brief review of support vector machine classifier related is discussed in this section. In the period 2007-2012, a lot of papers have been presented to represent the Support vector machine based intrusion detection. Some of the papers have been discussed below. A revise for improving the training time of SVM has been presented by Latifur Khan et al. BIB001 , particularly when contracting with large data sets using hierarchical clustering analysis in 2007. For gathering, they utilized the Dynamically Growing Self-Organizing Tree (DGSOT) algorithm since it had verified to triumph over the disadvantages of traditional hierarchical clustering algorithms (e.g., hierarchical agglomerative clustering). Among two classes, clustering analysis assisted discover the boundary points, which were the most capable data points to coach SVM. Using the clustering arrangement created by the DGSOT algorithm, they offered an approach of amalgamation of SVM and DGSOT, which in progress with a first training set and enlarge it slowly. In terms of precision loss and training time gain by means of a single bench-mark real data set they match up to their approach with the Rocchio Bundling technique and casual choice. In advanced to the above approach in the year 2011, Iftikhar Ahmad,Azween et al. have proposed a paper to surmount presentation issues an optimized interference detection mechanism by means of soft computing techniques BIB004 . The KDD-cup dataset was applied that was a benchmark for assessing the safety identification mechanisms. To change the key in models into a feature space the Principal Component Analysis (PCA) was applied. Selecting of a suitable quantity of principal components was an important problem. As an alternative of using conventional method, Genetic Algorithm (GA) was applied in the optimum choice of principal components accordingly. The Support Vector Machine (SVM) was employed for categorization reason. In addition, a proportional study was prepared with presented approaches. Therefore, the technique presented optimal interference detection mechanism was proficient to minimize amount of features and maximize the identification rates. S. Ganapathy et al. BIB002 have proposed an intelligent multi level classification technique for effective intrusion detection in Mobile Ad-hoc Networks in the same year. The algorithm used a combination of a tree classifier which used a labeled training data and an Enhanced Multiclass SVM algorithm. Moreover, an effective preprocessing technique had been proposed and implemented in this work in order to improve the detection accuracy and to reduce the processing time. As a way of dealing with conditions for independent labeling of regular traffic where class distribution does not present the imbalance necessary for SVM algorithms, an approach has been presented by Carlos A. Catania et al. BIB003 in 2012. In such case, the self-governing labeling process was made by SNORT, a misuse-based intrusion detection system. The use of the planned autonomous labeling approach not only outperforms presented SVM alternatives that was shown by the experiments conducted on the 1998 DARPA dataset however attains developments over SNORT itself also under some attack distributions. 