Reseach on U2R Attacks Detection Based on Improved Artificial Bee Colony Combined with Optimized Random Forest

doi:10.3969/j.issn.1671-1122.2018.12.006

Abstract

Abstract: Aiming at the problem of low detection rate of U2R attacks in IDS, this paper proposes a model that combined an improved artificial bee colony algorithm (ABC) with the optimized random forest (RF). Firstly, the model improved the initialization method and search strategy of the traditional ABC, optimized the method of ranking of feature importance scores in the traditional RF. Then the model combined the two improved algorithm. Experiments with NSL-KDD datasets show that the attack detection model based on the improved artificial bee combined with the optimization random forest algorithm (RF-IABC) can extract the optimal feature set of attack type accurately, then classify and predict the attack data, improve the detection rate of U2R type attacks by IDS effectively.

Key words: IDS, U2R attacks, improved artificial bee colony, optimized random forest

CLC Number:

TP309

ZHAI Jiqiang, XIAO Yajun, YANG Hailu, WANG Jian. Reseach on U2R Attacks Detection Based on Improved Artificial Bee Colony Combined with Optimized Random Forest[J]. 信息网络安全, 2018, 18(12): 38-45.

References

[1] RICHHARIYA R, MANJHWAR A, MAKWANA R.A Hybrid Approach for User to Root and Remote to Local Attack[J]. International Journal of Computer Sciences and Engineering, 2017, 5(6): 73-79.
[2] HU Yangrui, CHEN Xingshu, WANG Junfeng, et al.Anomalous Traffic Detection Based on Traffic Behavior Characteristics[J]. Netinfo Security, 2016, 16(11): 45-51.
胡洋瑞,陈兴蜀,王俊峰,等. 基于流量行为特征的异常流量检测[J]. 信息网络安全,2016,16(11):45-51.
[3] BAHL S, SHARMA S K.Performance Analysis of User to Root Attack Class Using Correlation Based Feature Selection Model[C]// Springer. 2015 Computational Intelligence in Security for Information Systems Conference, June 15-17, 2015, Burgos, Spain. Heidelberg: Springer, 2015: 177-187.
[4] BASHL S, SHARMA S.Detection Rate Analysis for User to Root Attack Class using Correlation Feature Selection[C]// IEEE. International Conference on Computing, Communication & Automation, July 23-25, 2015, Noida, India. New Jersey: IEEE, 2015: 66-71.
[5] SHAHBAZ M, WANG Xianbin, Behnad A, et al.On Efficiency Enhancement of the Correlation-based Feature Selection for Intrusion Detection Systems[C]// IEEE. 7th Annual Information Technology, Electronics and Mobile Communication Conference, October 13-15, 2016, Vancouver, BC, Canada. New Jersey: IEEE, 2016: 1-7.
[6] XIA Yuming, HU Shaoyong, ZHU Shaomin, et al.Reserch on the Method of Network Attack Detection Based on Convolution Neural Network[J]. Netinfo Security, 2017, 17(11): 32-36.
夏玉明,胡绍勇,朱少民,等. 基于卷积神经网络的网络攻击检测方法研究[J]. 信息网络安全,2017,17(11):32-36.
[7] SAHASRABUDDHE A, NAIKADE S, RAMASWAMY R.Survey on Intrusion Detection System Using Data Mining Techniques[J]. International Research Journal of Engineering and Technology, 2017, 4(5): 1780-1784.
[8] CHOURE C, PATIL L H.A Literature Survey on Intrusion Detection and Protection System Using Data Mining[J]. International Journal of Advance Research, Ideas and Innovations in Technology, 2018, 4(1): 61-65.
[9] 戚名钰,刘铭,傅彦铭. 基于PCA的SVM网络入侵检测研究[J]. 信息网络安全,2015,15(2):15-18:
QI Mingyu, LIU Ming, FU Yanming.Research on Network Intrusion Detection Using Support Vector Machines Based on Principal Component Analysis[J]. Netinfo Security, 2015, 15(2): 15-18.
[10] ZHAO Jing, WEI Bin, LUO Peng, et al.Intrusion Detection Method Based on Hidden Markov Model[J]. Journal of Sichuan University: Engineering Science Edition, 2016, 48(1): 106-110.
赵婧,魏彬,罗鹏,等. 基于隐马尔可夫模型的入侵检测方法[J]. 四川大学学报:工程科学版,2016,48(1):106-110.
[11] FARNAAZ N, JABBAR M A. Random Forest Modeling for Network Intrusion Detection System[EB/OL]. https://core.ac.uk/download/pdf/82689462.pdf, 2018-1-11.
[12] LIN Weining, CHEN Mingzhi, ZHAN Yunqing, et al.Research on an Intrusion Detection Algorithm Based on PCA and Random-forest Classification[J]. Netinfo Security, 2017, 17(11): 50-54.
林伟宁,陈明志,詹云清,等. 一种基于PCA和随机森林分类的入侵检测算法研究[J]. 信息网络安全,2017,17(11):50-54.
[13] ADNAN M.Improving the Random Forest Algorithm by Randomly Varying the Size of the Bootstrap Samples[C]// IEEE. 15th International Conference on Information Reuse and Integration, August 13-15, 2014, Redwood City, CA, USA. New Jersey: IEEE, 2014: 303-308.
[14] BIAU G, SCORNET E.A Random Forest Guided Tour[J]. TEST, 2016, 25(2): 197-227.
[15] DUBITZKY W, WOLKENHAUER O, CHO K H, et al.Student’s t-Test[J]. Encyclopedia of Systems Biology, 2013, 17(4): 124-141.
[16] KIM K.T Test as a Parametric Statistic[J]. Korean Journal Anesthesiology, 2015, 68(6): 540-546.
[17] MERNIK M, LIU S, KARABOGA D.On Clarifying Misconceptions when Comparing Variants of the Artificial Bee Colony Algorithm by Offering a New Implementation[J]. Information Sciences an International Journal, 2015, 291(C): 115-127.
[18] KONG Xiangyu, LIU Sanyang, WANG Zhen.A New Hybrid Artificial Bee Colony Algorithm for Global Optimization[J]. International Journal of Computer Science Issues, 2013, 10(1): 287-301.
[19] MOHAMED A.An Efficient Modified Differential Evolution Algorithm for Solving Constrained Non-linear Integer and Mixed-integer Global Optimization Problems[J]. International Journal of Machine Learning and Cybernetics, 2017, 8(3): 989-1007.
[20] INGRE B, YADAV A, SONI A K.Decision Tree Based Intrusion Detection System for NSL-KDD Dataset[C]// Springer. 2017 International Conference on Information and Communication Technology for Intelligent Systems, March 25-26, 2017, Ahmedabad, India. Heidelberg: Springer, 2017: 207-218.
[21] MEENA G, CHOUDHARY R.A Review Paper on IDS Classification Using KDD 99 and NSL KDD Dataset in WEKA[C]// IEEE. 2017 International Conference on Computer, Communications and Electronics, July 1-2, 2017, Jaipur, India. New Jersey: IEEE, 2017: 553-558.
[22] UNB. NSL-KDD Dataset[EB/OL]. http://www.unb.ca/cic/datasets/nsl.html, 2017-7-10.