Shallow and Deep Networks Intrusion Detection System: A Taxonomy and Survey
---
paper_title: A comparative analysis of SVM and its stacking with other classification algorithm for intrusion detection

paper_content:

Network attacks have become more pervasive in the cyber world. There are various attacks such as denial of service, scanning, privilege escalation that is increasing day by day leading towards the requirement of a more robust and adaptable security techniques. Anomaly detection is the main focus of our paper. Support Vector Machine (SVM) is one of the good classification algorithm applied specially for intrusion detection. However, its performance can be significantly improved when it is applied in integration with other classifiers. In this paper, we have performed a comparative analysis of SVM classifier's performance when it is stacked with other classifiers like BayesNet, AdaBoost, Logistic, IBK, J48, RandomForest, JRip, OneR and SimpleCart. Multi-Classifier algorithm have better classification power when compared to a single classifier algorithm specially for detecting low frequency attacks such as guess password, rootkits, spyware etc. Our preliminary analysis over NSL-KDD'99 dataset shows that stacking of SVM and Random Forest provides the best performance with accuracy of around 97.50% which apparently better than SVM (91.81%).
---
paper_title: Testing Intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory

paper_content:

In 1998 and again in 1999, the Lincoln Laboratory of MIT conducted a comparative evaluation of intrusion detection systems (IDSs) developed under DARPA funding. While this evaluation represents a significant and monumental undertaking, there are a number of issues associated with its design and execution that remain unsettled. Some methodologies used in the evaluation are questionable and may have biased its results. One problem is that the evaluators have published relatively little concerning some of the more critical aspects of their work, such as validation of their test data. The appropriateness of the evaluation techniques used needs further investigation. The purpose of this article is to attempt to identify the shortcomings of the Lincoln Lab effort in the hope that future efforts of this kind will be placed on a sounder footing. Some of the problems that the article points out might well be resolved if the evaluators were to publish a detailed description of their procedures and the rationale that led to their adoption, but other problems would clearly remain./par>
---
paper_title: A Literature Survey and Comprehensive Study of Intrusion Detection

paper_content:

With the rapid expansion of computer usage and computer network the security of the computer system has became very important. Every day new kind of attacks are being faced by industries. As the threat becomes a serious matter year by year, intrusion detection technologies are indispensable for network and computer security. A variety of intrusion detection approaches be present to resolve this severe issue but the main problem is performance. It is important to increase the detection rates and reduce false alarm rates in the area of intrusion detection. In order to detect the intrusion, various approaches have been developed and proposed over the last decade. In this paper, a detailed survey of intrusion detection based various techniques has been presented. Here, the techniques are classified as follows: i) papers related to Neural network ii) papers related to Support vector machine iii) papers related to K-means classifier iv) papers related to hybrid technique and v) paper related to other detection techniques. For comprehensive analysis, detection rate, time and false alarm rate from various research papers have been taken.
---
paper_title: A survey of intrusion detection techniques for cyber-physical systems

paper_content:

Pervasive healthcare systems, smart grids, and unmanned aircraft systems are examples of Cyber-Physical Systems (CPSs) that have become highly integrated in the modern world. As this integration deepens, the importance of securing these systems increases. In order to identify gaps and propose research directions in CPS intrusion detection research, we survey the literature of this area. Our approach is to classify modern CPS Intrusion Detection System (IDS) techniques based on two design dimensions: detection technique and audit material. We summarize advantages and drawbacks of each dimension’s options. We also summarize the most and least studied CPS IDS techniques in the literature and provide insight on the effectiveness of IDS techniques as they apply to CPSs. Finally, we identify gaps in CPS IDS research and suggest future research areas.
---
paper_title: Network intrusion detection

paper_content:

Intrusion detection is a new, retrofit approach for providing a sense of security in existing computers and data networks, while allowing them to operate in their current "open" mode. The goal of intrusion detection is to identify unauthorized use, misuse, and abuse of computer systems by both system insiders and external penetrators. The intrusion detection problem is becoming a challenging task due to the proliferation of heterogeneous computer networks since the increased connectivity of computer systems gives greater access to outsiders and makes it easier for intruders to avoid identification. Intrusion detection systems (IDSs) are based on the beliefs that an intruder's behavior will be noticeably different from that of a legitimate user and that many unauthorized actions are detectable. Typically, IDSs employ statistical anomaly and rulebased misuse models in order to detect intrusions. A number of prototype IDSs have been developed at several institutions, and some of them have also been deployed on an experimental basis in operational systems. In the present paper, several host-based and network-based IDSs are surveyed, and the characteristics of the corresponding systems are identified. The host-based systems employ the host operating system's audit trails as the main source of input to detect intrusive activity, while most of the network-based IDSs build their detection mechanism on monitored network traffic, and some employ host audit trails as well. An outline of a statistical anomaly detection algorithm employed in a typical IDS is also included. >
---
paper_title: Study on implementation of machine learning methods combination for improving attacks detection accuracy on Intrusion Detection System (IDS)

paper_content:

Many computer-based devices are now connected to the internet technology. These devices are widely used to manage critical infrastructure such energy, aviation, mining, banking and transportation. The strategic value of the data and the information transmitted over the Internet infrastructure has a very high economic value. With the increasing value of the data and the information, the higher the threats and attacks on such data and information. Statistical data shows a significant increase in threats to cyber security. The Government is aware of the threats to cyber security and respond to cyber security system that can perform early detection of threats and attacks the internet.
---
paper_title: The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection

paper_content:

Research in automated computer security intrusion detection, intrusion detection for short, is maturing. Several difficulties remain to be solved before intrusion detection systems become commonplace as part of real-world security solutions. One such difficulty regards the subject of effectiveness, how successful the intrusion detection system is at actually detecting intrusions with a high degree of certainty. With this as its starting point, this paper discusses the “base-rate fallacy” and how it influences the relative success of an intrusion detection system, under a set of reasonable circumstances. The conclusion is reached that the false-alarm rate quickly becomes a limiting factor.
---
paper_title: A revised taxonomy for intrusion-detection systems

paper_content:

Intrusion-detection systems aim at detecting attacks against computer systems and networks, or in general against information systems. Indeed, it is difficult to provide provably secure information systems and to maintain them in such a secure state during their lifetime and utilization. Sometimes, legacy or operational constraints do not even allow the definition of a fully secure information system. Therefore, intrusion- detection systems have the task of monitoring the usage of such systems to detect apparition of insecure states. They detect attempts and active misuse, either by legitimate users of the information systems or by external parties, to abuse their privileges or exploit security vulnerabilities. In a previous paper [Computer networks 31, 805–822 (1999)], we introduced a taxonomy of intrusion- detection systems that highlights the various aspects of this area. This paper extends the taxonomy beyond real- time intrusion detection to include additional aspects of security monitoring, such as vulnerability assessment.
---
paper_title: Intrusion detection systems: A survey and taxonomy

paper_content:

This paper presents a taxonomy of intrusion detection systems that is then used to survey and classify a number of research prototypes. The taxonomy consists of a classification first of the detection principle, and second of certain operational aspects of the intrusion detection system as such. The systems are also grouped according to the increasing difficulty of the problem they attempt to address. These classifications are used predictively, pointing towards a number of areas of future research in the field of intrusion detection.
---
paper_title: Review: Intrusion detection system: A comprehensive review

paper_content:

With the increasing amount of network throughput and security threat, the study of intrusion detection systems (IDSs) has received a lot of attention throughout the computer science field. Current IDSs pose challenges on not only capricious intrusion categories, but also huge computational power. Though there is a number of existing literatures to IDS issues, we attempt to give a more elaborate image for a comprehensive review. Through the extensive survey and sophisticated organization, we propose the taxonomy to outline modern IDSs. In addition, tables and figures we summarized in the content contribute to easily grasp the overall picture of IDSs.
---
paper_title: A flow based method to detect penetration

paper_content:

With the rapid expansion of the Internet, network security has become more and more important. IDS (Intrusion Detection System) is an important technology coping network attacks and is of two main types: network based (NIDS) and host based (HIDS). In this paper, we propose the conception of NFPPB (Network Flow Patterns of Penetrating Behavior) to network vulnerable ports and design a NIDS algorithm to detect infiltration behaviors of attacker. Essentially, NFPPB is a set of metrics calculated by network activities exploiting the vulnerabilities of hosts. The paper investigates choosing, generation and comparison of NFPPB metrics. Experiments show that the method is effective and with high efficiency. At last, the paper addresses the future direction and the points that need to be improved.
---
paper_title: Towards a Taxonomy of Intrusion-Detection Systems

paper_content:

Intrusion-detection systems aim at detecting attacks against computer systems and networks, or against information systems in general, as it is difficult to provide provably secure information systems and maintain them in such a secure state for their entire lifetime and for every utilization. Sometimes, legacy or operational constraints do not even allow a fully secure information system to be realized at all. Therefore, the task of intrusion-detection systems is to monitor the usage of such systems and to detect the apparition of insecure states. They detect attempts and active misuse by legitimate users of the information systems or external parties to abuse their privileges or exploit security vulnerabilities. In this paper, we introduce a taxonomy of intrusion-detection systems that highlights the various aspects of this area. This taxonomy defines families of intrusion-detection systems according to their properties. It is illustrated by numerous examples from past and current projects.
---
paper_title: A Literature Survey and Comprehensive Study of Intrusion Detection

paper_content:

With the rapid expansion of computer usage and computer network the security of the computer system has became very important. Every day new kind of attacks are being faced by industries. As the threat becomes a serious matter year by year, intrusion detection technologies are indispensable for network and computer security. A variety of intrusion detection approaches be present to resolve this severe issue but the main problem is performance. It is important to increase the detection rates and reduce false alarm rates in the area of intrusion detection. In order to detect the intrusion, various approaches have been developed and proposed over the last decade. In this paper, a detailed survey of intrusion detection based various techniques has been presented. Here, the techniques are classified as follows: i) papers related to Neural network ii) papers related to Support vector machine iii) papers related to K-means classifier iv) papers related to hybrid technique and v) paper related to other detection techniques. For comprehensive analysis, detection rate, time and false alarm rate from various research papers have been taken.
---
paper_title: Survey on intrusion detection methods

paper_content:

Intrusions in an information system are the activities that violate the security policy of the system, and intrusion detection is the process used to identify intrusions. Intrusion detection has been studied for approximately 20 years. It is based on the beliefs that an intruder’s behavior will be noticeably different from that of a legitimate user and that many unauthorized actions will be detectable. Intrusion detection systems (IDSs) are usually deployed along with other preventive security mechanisms, such as access control and authentication, as a second line of defense that protects information systems. There are several reasons that make intrusion detection a necessary part of the entire defense system. This paper describes various Intrusion Detection methods like pattern matching, state full pattern matching, protocol decode-based analysis etc and how fuzzy clustering can apply in IDS.
---
paper_title: An Intrusion-Detection Model

paper_content:

A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system.
---
paper_title: A revised taxonomy for intrusion-detection systems

paper_content:

Intrusion-detection systems aim at detecting attacks against computer systems and networks, or in general against information systems. Indeed, it is difficult to provide provably secure information systems and to maintain them in such a secure state during their lifetime and utilization. Sometimes, legacy or operational constraints do not even allow the definition of a fully secure information system. Therefore, intrusion- detection systems have the task of monitoring the usage of such systems to detect apparition of insecure states. They detect attempts and active misuse, either by legitimate users of the information systems or by external parties, to abuse their privileges or exploit security vulnerabilities. In a previous paper [Computer networks 31, 805–822 (1999)], we introduced a taxonomy of intrusion- detection systems that highlights the various aspects of this area. This paper extends the taxonomy beyond real- time intrusion detection to include additional aspects of security monitoring, such as vulnerability assessment.
---
paper_title: Non-Stationary Markov Models and Anomaly Propagation Analysis in IDS

paper_content:

We propose an anomaly based IDS that results in a decreased rate of false positives. It employs the new means of host-based detection in the system call domain with correlating anomalies reported by different hosts to the IDS server. A novel anomaly detection mechanism operating at the host level treats an application or service as a non-stationary stochastic process and models it as a non- stationary Markov chain that significantly improves model accuracy. A server-based procedure for the detection of anomaly propagation is employed. While false alarms do not propagate within the network, detected anomaly propagation with a high degree of certainty can be attributed to a computer worm; otherwise the alarms are to be treated as false positives.
---
paper_title: Network Intrusion Detection System Using Neural Networks

paper_content:

This paper presents a neural network-based intrusion detection method for the internet-based attacks on a computer network. Intrusion detection systems (IDS) have been created to predict and thwart current and future attacks. Neural networks are used to identify and predict unusual activities in the system. In particular, feedforward neural networks with the back propagation training algorithm were employed in this study. Training and testing data were obtained from the Defense Advanced Research Projects Agency (DARPA) intrusion detection evaluation data sets. The experimental results on real-data showed promising results on detection intrusion systems using neural networks.
---
paper_title: An Information-Theoretic Combining Method for Multi-Classifier Anomaly Detection Systems

paper_content:

Recent studies have shown that standalone anomaly classifiers used by network anomaly detectors are unable to provide acceptable accuracies in real-world deployments. To achieve higher accuracies, Network Anomaly Detection Systems (NADSs) now use multiple classifiers whose outputs are combined to formulate an aggregate anomaly score. Judicious methods of combining these classifiers' outputs are largely unexplored. In this paper, we propose a novel information-theoretic combining method which caters for the individual classifiers' accuracies in a multi-classifier NADS. We first show that existing combining schemes designed for or adapted to the problem of multi-classifier NADS combining do not provide good accuracies because they do not use individual classifiers' detection and false alarm rates in the combining process. Furthermore, we reveal that an accurate multi-classifier NADS, in addition to catering for the mean accuracy rates, must also consider the classifiers' variances during combining. Therefore, we propose a Standard Deviation normalized Entropy of Accuracy (SDnEA) method for classifier combining. Using 9 prominent classifiers operating on two publicly-available traffic datasets, we show that around 3%-10% increase in detection rate and a 40% decrease in false alarm rate over existing combining techniques can be provided by the proposed information-theoretic NADS combining technique.
---
paper_title: Intrusion detection systems: A survey and taxonomy

paper_content:

This paper presents a taxonomy of intrusion detection systems that is then used to survey and classify a number of research prototypes. The taxonomy consists of a classification first of the detection principle, and second of certain operational aspects of the intrusion detection system as such. The systems are also grouped according to the increasing difficulty of the problem they attempt to address. These classifications are used predictively, pointing towards a number of areas of future research in the field of intrusion detection.
---
paper_title: A survey of intrusion detection techniques

paper_content:

Today's computer systems are vulnerable both to abuse by insiders and to penetration by outsiders, as evidenced by the growing number of incidents reported in the press. To close all security loopholes from today's systems is infeasible, and no combination of technologies can prevent legitimate users from abusing their authority in a system; thus auditing is viewed as the last line of defense. Over the past several years, the computer security community has been developing automated tools to analyze computer system audit data for suspicious user behavior. This paper describes the use of such tools for detecting computer system intrusion and describes further technologies that may be of use for intrusion detection in the future.
---
paper_title: A Markov Chain Model of Temporal Behavior for Anomaly Detection

paper_content:

This paper presents an anomaly detection technique to detect intrusions into computer and network systems. In this technique, a Markov chain model is used to represent a temporal profile of normal behavior in a computer and network system. The Markov chain model of the norm profile is learned from historic data of the system’s normal behavior. The observed behavior of the system is analyzed to infer the probability that the Markov chain model of the norm profile supports the observed behavior. A low probability of support indicates an anomalous behavior that may result from intrusive activities. The technique was implemented and tested on the audit data of a Sun Solaris system. The testing results showed that the technique clearly distinguished intrusive activities from normal activities in the testing data.
---
paper_title: Anomaly-based network intrusion detection: Techniques, systems and challenges

paper_content:

The Internet and computer networks are exposed to an increasing number of security threats. With new types of attacks appearing continually, developing flexible and adaptive security oriented approaches is a severe challenge. In this context, anomaly-based network intrusion detection techniques are a valuable technology to protect target systems and networks against malicious activities. However, despite the variety of such methods described in the literature in recent years, security tools incorporating anomaly detection functionalities are just starting to appear, and several important problems remain to be solved. This paper begins with a review of the most well-known anomaly-based intrusion detection techniques. Then, available platforms, systems under development and research projects in the area are presented. Finally, we outline the main challenges to be dealt with for the wide scale deployment of anomaly-based intrusion detectors, with special emphasis on assessment issues.
---
paper_title: A Multi-order Markov Chain Based Scheme for Anomaly Detection

paper_content:

This paper presents a feasible multi-order Markov chain based scheme for anomaly detection in server systems. In our approach, both the high-order Markov chain and multivariate time series are taken into account, along with the detailed design of training and testing algorithms. To evaluate its effectiveness, the Defense Advanced Research Projects Agency (DARPA) Intrusion Detection Evaluation Data Set is used as stimuli to our model, by which system calls and the corresponding return values form a two-dimensional input set. The calculation result shows that this approach is able to produce several effective indicators of anomalies. In addition to the absolute values given by an individual single-order model, we also notice a novelty unprecedented before, i.e., the changes in ranking positions of outputs from different-order ones also correlate closely with abnormal behaviours. Moreover, the analysis and application proves our approach's efficiency in consuming reasonable cost of time and storage.
---
paper_title: A survey of intrusion detection techniques in Cloud

paper_content:

In this paper, we survey different intrusions affecting availability, confidentiality and integrity of Cloud resources and services. Proposals incorporating Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) in Cloud are examined. We recommend IDS/IPS positioning in Cloud environment to achieve desired security in the next generation networks.
---
paper_title: Anomalous Payload-Based Network Intrusion Detection

paper_content:

We present a payload-based anomaly detector, we call PAYL, for intrusion detection. PAYL models the normal application payload of network traffic in a fully automatic, unsupervised and very effecient fashion. We first compute during a training phase a profile byte frequency distribution and their standard deviation of the application payload flowing to a single host and port. We then use Mahalanobis distance during the detection phase to calculate the similarity of new data against the pre-computed profile. The detector compares this measure against a threshold and generates an alert when the distance of the new input exceeds this threshold. We demonstrate the surprising effectiveness of the method on the 1999 DARPA IDS dataset and a live dataset we collected on the Columbia CS department network. In once case nearly 100% accuracy is achieved with 0.1% false positive rate for port 80 traffic.
---
paper_title: A revised taxonomy for intrusion-detection systems

paper_content:

Intrusion-detection systems aim at detecting attacks against computer systems and networks, or in general against information systems. Indeed, it is difficult to provide provably secure information systems and to maintain them in such a secure state during their lifetime and utilization. Sometimes, legacy or operational constraints do not even allow the definition of a fully secure information system. Therefore, intrusion- detection systems have the task of monitoring the usage of such systems to detect apparition of insecure states. They detect attempts and active misuse, either by legitimate users of the information systems or by external parties, to abuse their privileges or exploit security vulnerabilities. In a previous paper [Computer networks 31, 805–822 (1999)], we introduced a taxonomy of intrusion- detection systems that highlights the various aspects of this area. This paper extends the taxonomy beyond real- time intrusion detection to include additional aspects of security monitoring, such as vulnerability assessment.
---
paper_title: NIS04-6: A Time- and Memory- Efficient String Matching Algorithm for Intrusion Detection Systems

paper_content:

Intrusion Detection Systems (IDSs) are known as useful tools for identifying malicious attempts over the network. The most essential part to an IDS is the searching engine that inspects every packet through the network. To strictly defend the protectorate, an IDS must be able to inspect packets at line rate and also provide guaranteed performance even under heavy attacks. Therefore, in this paper we propose an efficient string matching algorithm (named ACM) with compact memory as well as high worst-case performance. Using a magic number heuristic based on the Chinese remainder theorem, the proposed ACM significantly reduces the memory requirement without bringing complex processes. Furthermore, the latency of off-chip memory references is drastically reduced. The proposed ACM can be easily implemented in hardware and software. As a result, ACM enables cost-effective and efficient IDSs.
---
paper_title: A novel Network Intrusion Detection System (NIDS) based on signatures search of data mining

paper_content:

Network security has been a very important issue, since the rising evolution of the Internet. There has been an increasing need for security systems against the external attacks from the hackers. One important type is the intrusion detection system (IDS). There are two major categories of the analysis techniques of IDS: the anomaly detection and the misuse detection. Here we forcus on misuse detection, the misuse detection collected the attack signatures in a database as the same as virus protection software to detect the relate attacks, we propose an algorithm to use the known signature to find the signature of the related attack quickly.
---
paper_title: Towards a Taxonomy of Intrusion-Detection Systems

paper_content:

Intrusion-detection systems aim at detecting attacks against computer systems and networks, or against information systems in general, as it is difficult to provide provably secure information systems and maintain them in such a secure state for their entire lifetime and for every utilization. Sometimes, legacy or operational constraints do not even allow a fully secure information system to be realized at all. Therefore, the task of intrusion-detection systems is to monitor the usage of such systems and to detect the apparition of insecure states. They detect attempts and active misuse by legitimate users of the information systems or external parties to abuse their privileges or exploit security vulnerabilities. In this paper, we introduce a taxonomy of intrusion-detection systems that highlights the various aspects of this area. This taxonomy defines families of intrusion-detection systems according to their properties. It is illustrated by numerous examples from past and current projects.
---
paper_title: Intrusion detection systems: A survey and taxonomy

paper_content:

This paper presents a taxonomy of intrusion detection systems that is then used to survey and classify a number of research prototypes. The taxonomy consists of a classification first of the detection principle, and second of certain operational aspects of the intrusion detection system as such. The systems are also grouped according to the increasing difficulty of the problem they attempt to address. These classifications are used predictively, pointing towards a number of areas of future research in the field of intrusion detection.
---
paper_title: A brief taxonomy of intrusion detection strategies

paper_content:

This paper provide a brief taxonomy and literature review regarding intrusion detection. It highlights the two main methods of classifying intrusion detection systems: network-based v. host-based and anomaly detection v. signature/misuse detection. An extensive bibliography is provided as a starting point for research in the field of intrusion detection.
---
paper_title: Network intrusion detection

paper_content:

Intrusion detection is a new, retrofit approach for providing a sense of security in existing computers and data networks, while allowing them to operate in their current "open" mode. The goal of intrusion detection is to identify unauthorized use, misuse, and abuse of computer systems by both system insiders and external penetrators. The intrusion detection problem is becoming a challenging task due to the proliferation of heterogeneous computer networks since the increased connectivity of computer systems gives greater access to outsiders and makes it easier for intruders to avoid identification. Intrusion detection systems (IDSs) are based on the beliefs that an intruder's behavior will be noticeably different from that of a legitimate user and that many unauthorized actions are detectable. Typically, IDSs employ statistical anomaly and rulebased misuse models in order to detect intrusions. A number of prototype IDSs have been developed at several institutions, and some of them have also been deployed on an experimental basis in operational systems. In the present paper, several host-based and network-based IDSs are surveyed, and the characteristics of the corresponding systems are identified. The host-based systems employ the host operating system's audit trails as the main source of input to detect intrusive activity, while most of the network-based IDSs build their detection mechanism on monitored network traffic, and some employ host audit trails as well. An outline of a statistical anomaly detection algorithm employed in a typical IDS is also included. >
---
paper_title: An integrated model of intrusion detection based on neural network and expert system

paper_content:

Intrusion detection technology is an effective approach to dealing with the problems of network security. In this paper, it presents an intrusion detection model based on neural network and expert system. The key idea is to aim at taking advantage of classification abilities of neural network for unknown attacks and the expert-based system for the known attacks. We employ data from the third international knowledge discovery and data mining tools competition (KDDcup'99) to train and test the feasibility of our proposed neural network component. According to the results of our experiment, our model achieves 96.6 percent detection rate for DOS and probing intrusions, and less than 0.04 percent false alarm rate. Expert system can detect R2L and U2R intrusions more accurately than neural network. Therefore, hybrid model improves the performance to detect intrusions
---
paper_title: An Intrusion-Detection Model

paper_content:

A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system.
---
paper_title: INTRODUCTION TO MACHINE LEARNINGIntroduction to Machine Learning

paper_content:

This chapter introduces the foundations of machine learning that are necessary to motivate its combination to evolutionary algorithms and image processing. In the chapter, we will describe several machine learning tools, suitable for a wide variety of data and tasks. The goal is not to describe the total number of techniques, but instead to present a general view of the field through the description of the mail problems considered in machine learning.
---
paper_title: Lowering the barrier to applying machine learning

paper_content:

Machine learning algorithms are key components in many cutting edge applications of computation. However, the full potential of machine learning has not been realized because using machine learning is hard, even for otherwise tech-savvy developers. This is because developing with machine learning is different than normal programming. My thesis is that developers applying machine learning need new general-purpose tools that provide structure for common processes and common pipelines while remaining flexible to account for variability in problems. In this paper, I describe my efforts to understanding the difficulties that developers face when applying machine learning. I then describe Gestalt, a general-purpose integrated development environment designed the application of machine learning. Finally, I describe work on developing a pattern language for building machine learning systems and creating new techniques that help developers understand the interaction between their data and learning algorithms.
---
paper_title: Network Intrusion Detection and Prevention

paper_content:

With the complexity of today's networks, it is impossible to know you are actually secure. You can prepare your network's defenses, but what threats will be thrown at it, what combinations will be tried, and what directions they will come from are all unknown variables. Most medium and large-scale network infrastructures include multiple high-speed connections to the Internet and support many customer collaborative networks, thousands of internal users and various web servers. Many of these systems are faced with an ever-increasing likelihood of unplanned downtime due to various attacks and security breaches. In this environment of uncertainty, which is full of hackers and malicious threats, those systems that are the best at maintaining the continuity of their services (i.e., survive the attacks) enjoy a significant competitive advantage. Minimizing unexpected and unplanned downtime can be done by identifying, prioritizing and defending against misuse, attacks and vulnerabilities. Intrusion Detection and Prevention is a rapidly growing field that deals with detecting and responding to malicious network traffic and computer misuse. Intrusion detection is the process of identifying and (possibly) responding to malicious activities targeted at computing and network resources. Any hardware or software automation that monitors, detects or responds to events occurring in a network or on a host computer is considered relevant to the intrusion detection approach. Different intrusion detection systems provide varying functionalities and benefits. Network Intrusion Detection and Prevention: Concepts and Techniques provides detailed and concise information on different types of attacks, theoretical foundation of attack detection approaches, implementation, data collection, evaluation, and intrusion response. Additionally, it provides an overview of some of the commercially/publicly available intrusion detection and response systems. On the topic of intrusion detection system it is impossible to include everything there is to say on all subjects. However, we have tried to cover the most important and common ones. Network Intrusion Detection and Prevention: Concepts and Techniques is designed for researchers and practitioners in industry. This book is suitable for advanced-level students in computer science as a reference book as well.
---
paper_title: Statistical Pattern Recognition: A Review

paper_content:

The primary goal of pattern recognition is supervised or unsupervised classification. Among the various frameworks in which pattern recognition has been traditionally formulated, the statistical approach has been most intensively studied and used in practice. More recently, neural network techniques and methods imported from statistical learning theory have been receiving increasing attention. The design of a recognition system requires careful attention to the following issues: definition of pattern classes, sensing environment, pattern representation, feature extraction and selection, cluster analysis, classifier design and learning, selection of training and test samples, and performance evaluation. In spite of almost 50 years of research and development in this field, the general problem of recognizing complex patterns with arbitrary orientation, location, and scale remains unsolved. New and emerging applications, such as data mining, web searching, retrieval of multimedia data, face recognition, and cursive handwriting recognition, require robust and efficient pattern recognition techniques. The objective of this review paper is to summarize and compare some of the well-known methods used in various stages of a pattern recognition system and identify research topics and applications which are at the forefront of this exciting and challenging field.
---
paper_title: On the detection of anomalous system call arguments

paper_content:

Learning-based anomaly detection systems build models of the expected behavior of applications by analyzing events that are generated during their normal operation. Once these models have been established, subsequent events are analyzed to identify deviations, given the assumption that anomalies usually represent evidence of an attack. Host-based anomaly detection systems often rely on system call traces to build models and perform intrusion detection. Recently, these systems have been criticized, and it has been shown how detection can be evaded by executing an attack using a carefully crafted exploit. This weakness is caused by the fact that existing models do not take into account all available features of system calls. In particular, some attacks will go undetected because the models do not make use of system call arguments. To solve this problem, we have developed an anomaly detection technique that utilizes the information contained in these parameters. Based on our approach, we developed a host-based intrusion detection system that identifies attacks using a composition of various anomaly metrics. This paper presents our detection techniques and the tool based on them. The experimental evaluation shows that it is possible to increase both the effectiveness and the precision of the detection process compared to previous approaches. Nevertheless, the system imposes only minimal overhead.
---
paper_title: Network Intrusion Detection and Prevention

paper_content:

With the complexity of today's networks, it is impossible to know you are actually secure. You can prepare your network's defenses, but what threats will be thrown at it, what combinations will be tried, and what directions they will come from are all unknown variables. Most medium and large-scale network infrastructures include multiple high-speed connections to the Internet and support many customer collaborative networks, thousands of internal users and various web servers. Many of these systems are faced with an ever-increasing likelihood of unplanned downtime due to various attacks and security breaches. In this environment of uncertainty, which is full of hackers and malicious threats, those systems that are the best at maintaining the continuity of their services (i.e., survive the attacks) enjoy a significant competitive advantage. Minimizing unexpected and unplanned downtime can be done by identifying, prioritizing and defending against misuse, attacks and vulnerabilities. Intrusion Detection and Prevention is a rapidly growing field that deals with detecting and responding to malicious network traffic and computer misuse. Intrusion detection is the process of identifying and (possibly) responding to malicious activities targeted at computing and network resources. Any hardware or software automation that monitors, detects or responds to events occurring in a network or on a host computer is considered relevant to the intrusion detection approach. Different intrusion detection systems provide varying functionalities and benefits. Network Intrusion Detection and Prevention: Concepts and Techniques provides detailed and concise information on different types of attacks, theoretical foundation of attack detection approaches, implementation, data collection, evaluation, and intrusion response. Additionally, it provides an overview of some of the commercially/publicly available intrusion detection and response systems. On the topic of intrusion detection system it is impossible to include everything there is to say on all subjects. However, we have tried to cover the most important and common ones. Network Intrusion Detection and Prevention: Concepts and Techniques is designed for researchers and practitioners in industry. This book is suitable for advanced-level students in computer science as a reference book as well.
---
paper_title: Intrusion detection using optimal genetic feature selection and SVM based classifier

paper_content:

In the recent years, the rapid advancement of computer networks has led to many security problems by malicious users to the modern computer systems. Hence, it is necessary to detect illegitimate users by monitoring the unusual user activities in the network. In this paper, we propose an Intrusion Detection System (IDS) which uses a genetic algorithm based feature selection approach and a Support vector machine based classification algorithm. The combination of feature selection using the newly proposed genetic feature selection algorithm with Support Vector Machine based classification gives better results than other exiting methods. This is due to the fact that the proposed feature selection algorithm enhances the performance of the classifier in detecting the attacks by providing the most useful attributes. This IDS is more efficient in detecting the attacks and it effectively reduces the false alarm rate.
---
paper_title: Risk analysis in cyber situation awareness using Bayesian approach

paper_content:

The unpredictable cyber attackers and threats have to be detected in order to determine the outcome of risk in a network environment. This work develops a Bayesian network classifier to analyse the network traffic in a cyber situation. It is a tool that aids reasoning under uncertainty to determine certainty. It further analyze the level of risk using a modified risk matrix criteria. The classifier developed was experimented with various records extracted from the KDD Cup'99 dataset with 490,021 records. The evaluations showed that the Bayesian Network classifier is a suitable model which resulted in same performance level for classifying the Denial of Service (DoS) attacks with Association Rule Mining while as well as Genetic Algorithm, the Bayesian Network classifier performed better in classifying probe and User to Root (U2R) attacks and classified DoS equally. The result of the classification showed that Bayesian network classifier is a classification model that thrives well in network security. Also, the level of risk analysed from the adapted risk matrix showed that DoS attack has the most frequent occurrence and falls in the generally unacceptable risk zone.
---
paper_title: A Tutorial on Support Vector Machines for Pattern Recognition

paper_content:

The tutorial starts with an overview of the concepts of VC dimension and structural risk minimization. We then describe linear Support Vector Machines (SVMs) for separable and non-separable data, working through a non-trivial example in detail. We describe a mechanical analogy, and discuss when SVM solutions are unique and when they are global. We describe how support vector training can be practically implemented, and discuss in detail the kernel mapping technique which is used to construct SVM solutions which are nonlinear in the data. We show how Support Vector machines can have very large (even infinite) VC dimension by computing the VC dimension for homogeneous polynomial and Gaussian radial basis function kernels. While very high VC dimension would normally bode ill for generalization performance, and while at present there exists no theory which shows that good generalization performance is guaranteed for SVMs, there are several arguments which support the observed high accuracy of SVMs, which we review. Results of some experiments which were inspired by these arguments are also presented. We give numerous examples and proofs of most of the key theorems. There is new material, and I hope that the reader will find that even old material is cast in a fresh light.
---
paper_title: A kernel path algorithm for support vector machines

paper_content:

The choice of the kernel function which determines the mapping between the input space and the feature space is of crucial importance to kernel methods. The past few years have seen many efforts in learning either the kernel function or the kernel matrix. In this paper, we address this model selection issue by learning the hyperparameter of the kernel function for a support vector machine (SVM). We trace the solution path with respect to the kernel hyperparameter without having to train the model multiple times. Given a kernel hyperparameter value and the optimal solution obtained for that value, we find that the solutions of the neighborhood hyperparameters can be calculated exactly. However, the solution path does not exhibit piecewise linearity and extends nonlinearly. As a result, the breakpoints cannot be computed in advance. We propose a method to approximate the breakpoints. Our method is both efficient and general in the sense that it can be applied to many kernel functions in common use.
---
paper_title: Incremental Support Vector Machine Learning: An Angle Approach

paper_content:

When new samples joining, classical Support Vector Machines must retrain the whole dataset which contains both historical samples and additional samples. Incremental Support Vector Machines can avoid retraining whole dataset through disposing of redundant samples. According to the angle, which is between the subtraction new sample from historical samples and the historical separation plane, MAISVM 1 (Minimum Angle Incremental Support Vector Machines 1) and MAISVM 2 (Minimum Angle Incremental Support Vector Machines 2) are proposed in this paper. The additional data, the support vectors and the samples, of which the angle between subtraction additional sample and the historical separation plane is minmum, are retained in MAISVM 1. Support vectors replace with generalized linear support vectors in MAISVM 2. Empirical results show that the MAISVM 1 has better accuracy than SVM-INC.[1], and a faster speed than LISVM [2]. The performance of MAISVM 2 is better than MAISVM 1. Its accuracy is no less than LISVM and its speed is faster than SVM-INC. MAISVM 1 can effectively discard the redundant samples in the neighborhoods of new sample. By selecting an appropriate subset of support vector set, MAISVM 2 is faster than SVM-INC.
---
paper_title: Layered approach for intrusion detection systems based genetic algorithm

paper_content:

An intrusion detection system monitors the activities of a given environment and determines whether these activities are malicious or legitimate (normal) based on system integrity, confidentiality and the availability of information resources. This work proposes a methodology to overcome all the weakness of single layer intrusion detection. In this work, a layered approach for intrusion detection is proposed which is based on genetic algorithm. In this model, the four layers correspond to four attack groups. They are Probe, DOS, R2L and U2R attacks. But in this approach, there is no mathematical method for calculating filter parameters for DOS, R2L, U2R attacks. So, we present a new approach which is genetic algorithm based, for calculating those parameters to make the system more secure. This efficiently detect R2L attack and 90 % accuracy detected.
---
paper_title: Competition and Cooperation in Extended Evolutionary Algorithms

paper_content:

The solution of complex optimization problems is a task often hard to tackle. A promising approach to overcome the difficulties is to combine multiple optimization methods. In this paper we introduce two extensions to Evolutionary Algorithms: the application of different strategies and competing subpopulations. Both extensions and their basic properties are discussed in detail. The utility of the extensions is presented using well-known test functions and real-world problems. The real-world problems are taken from the field of Evolutionary Testing – a major research project in automatic software testing at DaimlerChrysler. This paper concludes with a description of the advantages of the introduced extensions compared to similar work done by other researchers.
---
paper_title: Risk-based intrusion response management in IDS using Bayesian decision networks

paper_content:

Nowadays, from information security perspective, detection methods are not enough solely. Intrusion Detection and Response Systems (IDRS), as a proactive solution, continuously monitor system health based on Intrusion Detection System (IDS) alerts, so that malicious activities can be handled effectively by applying appropriate countermeasures to prevent problems from worsening and return the system to a healthy state. In this paper, a novel IDRS is proposed which processes the generated alerts in real time, correlates the alerts, calculates the risk of correlated alerts and models the attack scenarios and their countermeasures using the concept of Bayesian decision networks (BDNs). The proposed framework has two modes: online and offline. In the offline mode, a BDN model is constructed. Then, in the online mode, using the generated BDN, the next probable intentions of attackers are predicted and the optimal sets of countermeasures are identified to prevent the attackers reaching their goals. The experimental results show that the proposed method effectively improves the security level of computer systems in terms of forecasting the multi-step attacks before they can compromise the network and determining the optimal security risk mitigation plans to prevent damages to the organizations assets.
---
paper_title: A Collaborative and Adaptive Intrusion Detection Based on SVMs and Decision Trees

paper_content:

Because network security has become one of the most serious problems in the world, intrusion detection is an important defence tool of network security. In this paper, A cooperative and adaptive intrusion detection method is proposed and a corresponding intrusion detection model is designed and implemented. The E-CARGO model is used to build the collaborative and adaptive intrusion detection model. The roles, agents and groups based on 2-class Support Vector Machines (SVMs) and Decision Trees (DTs) are described and built, and the adaptive scheduling mechanisms are designed. Finally, the KDD CUP 1999 data set is used to verify the effectiveness of our method. Experimental results show that the collaborative and adaptive intrusion detection method proposed in this paper is superior to the detection of the SVM in the detection accuracy and detection efficiency.
---
paper_title: Cross-breed type Bayesian network based intrusion detection system (CBNIDS)

paper_content:

Modern day internet is victimizer of the cynical network attacks due to excessive usage and massive connectivity demands. Machine learning is an efficient approach to prevent the intrusion and classify the network attacks. This study highlights the combined power of filter approaches in intrusion detection framework. Feature selection technique removes the redundant features and builds a time consuming better-performed intrusion detector framework. This study presents a cross-breed type feature selection approach using duo filter schemes for intrusion detection. In this framework feature selection technique eliminate the irrelevant features to reduce the time complexity and build a better model to predict the result with a greater accuracy and Bayesian network based classification model has been built up to predict the types of attacks. The experiment shows that the proposed framework exhibits a superior overall performance in terms of accuracy which is 97.2746% and keeps the false positive rate at a lower rate of 0.008. The model shows better performance in terms of accuracy than other leading state-of-the-arts frameworks like Boosted DT, Hidden NB, KNN and Markov chain. The NSL-KDD is used as benchmark data set with Weka library functions in the experimental setup.
---
paper_title: An effective model for anomaly IDS to improve the efficiency

paper_content:

We all know that the information passed through internet is in terms of packets. The alerts produced by all the existing intrusion detection systems are false alerts which can cause to decrease the efficiency and the accuracy is also low. The alerts generated by all the existing intrusion detection systems are isolated alerts and they will focuses on low-level attacks. So in this research paper diverse data mining techniques are used to reduce false alarm rate in intrusion detection system and for improving its' efficiency. The techniques which are used here are K-Nearest Neighbor, K-Means and Decision Table Majority rule based. This research operates on the KDD'99 dataset for diverse invasion recognition systems. In this paper we first apply the grouping on the KDD'99 dataset then it can be classified into four categories as U2R, R2L, DoS and Probe. The important goal of this paper is to decrease the false positive rate of IDS and attempt to improve its efficiency.
---
paper_title: Survey on clustering methods: Towards fuzzy clustering for big data

paper_content:

In this report, we propose to give a review of the most used clustering methods in the literature. First, we give an introduction about clustering methods, how they work and their main challenges. Second, we present the clustering methods with some comparisons including mainly the classical partitioning clustering methods like well-known k-means algorithms, Gaussian Mixture Modals and their variants, the classical hierarchical clustering methods like the agglomerative algorithm, the fuzzy clustering methods and Big data clustering methods. We present some examples of clustering algorithms comparison. Finally, we present our ideas to build a scalable and noise insensitive clustering system based on fuzzy type-2 clustering methods.
---
paper_title: A Hybrid Method for Intrusion Detection

paper_content:

Intrusion Detection Systems (IDSs) are used to detect malicious actions on information systems such as computing and networking systems. Abnormal behaviors or activities on the network systems could be detected by security systems. But, conventional security systems such as anti-virus and firewall cannot be successful in many malicious actions. To overcome this problem, better and more intelligent IDS solutions are required. In this study, a hybrid approach was proposed to use to detect network attacks. Genetic Algorithm (GA) and K-Nearest Neighbor (KNN) methods were combined to model and detect the attacks. KNN was employed to classify the attacks and GA was used to select k neighbors of an attack sample. This hybrid system was first applied in intrusion detection field. The system provides advantages such as, decreasing dependency of full training data set and providing plausible solution for intrusion detection. The results showed that the proposed system provides better results than single system.
---
paper_title: Anomaly Detection Based on Multi-Attribute Decision

paper_content:

Detection of intrusion attacks is an important issue in network security, this paper introduces a new anomaly detection scheme based on multi-attribute decisional framework. the system calls are used to characterize the process’s behavior, The data classification is performed by k-Nearest Neighbors(kNN) method and Support Vector Machines(SVM) model . the experiments with KDD Cup 1999 data demonstrate that our proposed method achieves 97.26% in hit rate with the false alarm rate 6.03% and outperforms the RIPPER method, and the time complexity is linear with the size of dataset and the number of attributes. since there is no need to build a profile for each program and check every sequence during the new program execution, the amount of calculation involved is largely reduced.
---
paper_title: Network intrusion detection and classification with Decision Tree and rule based approaches

paper_content:

Together with the extensive deployment of computer networks, the number of network attacks is greatly increasing. These attacks affect to availability and quality of services of the networks as well as confidentiality of private or important information data. In this paper, we present two network intrusion detection (IDS) techniques which are C4.5 Decision Tree and Ripper rules to assess and test an online dataset (RLD09 dataset). The dataset was collected from actual environment and then preprocessed to have only 13 features which are much simpler than existing traditional dataset such as KDD99 with 41 features. Thus, the RLD09 dataset features can provide real-time detection speed with low memory and CPU consumption. Our IDSs can classify the network data into classes which are normal data, Denial of Service (DoS) attack, and Probe (Port Scanning) attack. Our IDS techniques give the detection rates higher than 98%. Furthermore, they can detect unknown or new attacks, where the C4.5 Decision Tree detection rate is about the double of the Ripper rule detection rate. These tests can prove that our techniques are effective in detecting and classifying the new unknown attacks in the real environment.
---
paper_title: An improved KNN text classification algorithm based on density

paper_content:

Text classification has gained booming interest over the past few years. As a simple, effective and nonparametric classification method, KNN method is widely used in document classification. However, the uneven distribution in training set will affect the KNN classified result negatively. Moreover, the uneven distribution phenomenon of text is very common in documents on the Web. To tackling on this, this paper proposes an improved KNN method denoted by DBKNN. Experimental results show that the DBKNN algorithm can better serve classification requests for large sets of unevenly distributed documents.
---
paper_title: Machine learning in automated text categorization

paper_content:

The automated categorization (or classification) of texts into predefined categories has witnessed a booming interest in the last 10 years, due to the increased availability of documents in digital form and the ensuing need to organize them. In the research community the dominant approach to this problem is based on machine learning techniques: a general inductive process automatically builds a classifier by learning, from a set of preclassified documents, the characteristics of the categories. The advantages of this approach over the knowledge engineering approach (consisting in the manual definition of a classifier by domain experts) are a very good effectiveness, considerable savings in terms of expert labor power, and straightforward portability to different domains. This survey discusses the main approaches to text categorization that fall within the machine learning paradigm. We will discuss in detail issues pertaining to three different problems, namely, document representation, classifier construction, and classifier evaluation.
---
paper_title: Comparison of Machine Learning algorithms performance in detecting network intrusion

paper_content:

Organization has come to realize that network security technology has become very important in protecting its information. With tremendous growth of internet, attack cases are increasing each day along with the modern attack method. One of the solutions to this problem is by using Intrusion Detection System (IDS). Machine Learning is one of the methods used in the IDS. In recent years, Machine Learning Intrusion Detection system has been giving high accuracy and good detection on novel attacks. In this paper the performance of a Machine Learning algorithm called Decision Tree (J48) is evaluated and compared with two other Machine Learning algorithms namely Neural Network and Support Vector Machines which has been conducted by A. Osareh [1] for detecting intrusion. The algorithms were tested based on accuracy, detection rate, false alarm rate and accuracy of four categories of attacks. From the experiments conducted, it was found that the Decision tree (J48) algorithm outperformed the other two algorithms.
---
paper_title: Intrusion Detection in MANET using fuzzy logic

paper_content:

Mobile Ad hoc network (MANET) is a new paradigm in wireless revolution, which is a self-configured network of wireless mobile nodes. Due to proliferation of miniature yet powerful mobile computing devices, it is gaining acceptance and popularity. However, MANET is vulnerable to security attacks due to its inherent characteristics such as dynamic topology, lack of a centralized coordinator and open wireless channel. In this paper, we analyze some security attacks of MANET and we propose to identify the attack by using an Intrusion Detection System (IDS). The proposed IDS uses fuzzy logic to detect malicious behavior and identify the attacks.
---
paper_title: Network intrusion detection system using J48 Decision Tree

paper_content:

As the number of cyber attacks have increased, detecting the intrusion in networks become a very tough job. For network intrusion detection system (NIDS), many data mining and machine learning techniques are used. However, for evaluation, most of the researchers used KDD Cup 99 data set, which has widely criticized for not showing current network situation. In this paper we used a new labelled network dataset, called Kyoto 2006+ dataset. In Kyoto 2006+ data set, every instant is labelled as normal (no attack), attack (known attack) and unknown attack. We use Decision Tree (J48) algorithm to classify the network packet that can be used for NIDS. For training and testing we used 134665 network instances. The generated rules works with 97.2% correctness for detecting the connection i.e., no attack, known attack or unknown attack.
---
paper_title: A new approach to intrusion detection based on an evolutionary soft computing model using neuro-fuzzy classifiers

paper_content:

An intrusion detection system's main goal is to classify activities of a system into two major categories: normal and suspicious (intrusive) activities. Intrusion detection systems usually specify the type of attack or classify activities in some specific groups. The objective of this paper is to incorporate several soft computing techniques into the classifying system to detect and classify intrusions from normal behaviors based on the attack type in a computer network. Among the several soft computing paradigms, neuro-fuzzy networks, fuzzy inference approach and genetic algorithms are investigated in this work. A set of parallel neuro-fuzzy classifiers are used to do an initial classification. The fuzzy inference system would then be based on the outputs of neuro-fuzzy classifiers, making final decision of whether the current activity is normal or intrusive. Finally, in order to attain the best result, genetic algorithm optimizes the structure of our fuzzy decision engine. The experiments and evaluations of the proposed method were performed with the KDD Cup 99 intrusion detection dataset.
---
paper_title: A hybrid system for reducing the false alarm rate of anomaly intrusion detection system

paper_content:

In this paper, we propose a hybrid intrusion detection system that combines k-Means, and two classifiers: K-nearest neighbor and Naive Bayes for anomaly detection. It consists of selecting features using an entropy based feature selection algorithm which selects the important attributes and removes the irredundant attributes. This algorithm operates on the KDD-99 Data set; this data set is used worldwide for evaluating the performance of different intrusion detection systems. The next step is clustering phase using k-Means. We have used the KDD99 (knowledge Discovery and Data Mining) intrusion detection contest. This system can detect the intrusions and further classify them into four categories: Denial of Service (DoS), U2R (User to Root), R2L (Remote to Local), and probe. The main goal is to reduce the false alarm rate of IDS1.
---
paper_title: Machine Learning: A Probabilistic Perspective

paper_content:

Today's Web-enabled deluge of electronic data calls for automated methods of data analysis. Machine learning provides these, developing methods that can automatically detect patterns in data and then use the uncovered patterns to predict future data. This textbook offers a comprehensive and self-contained introduction to the field of machine learning, based on a unified, probabilistic approach. The coverage combines breadth and depth, offering necessary background material on such topics as probability, optimization, and linear algebra as well as discussion of recent developments in the field, including conditional random fields, L1 regularization, and deep learning. The book is written in an informal, accessible style, complete with pseudo-code for the most important algorithms. All topics are copiously illustrated with color images and worked examples drawn from such application domains as biology, text processing, computer vision, and robotics. Rather than providing a cookbook of different heuristic methods, the book stresses a principled model-based approach, often using the language of graphical models to specify models in a concise and intuitive way. Almost all the models described have been implemented in a MATLAB software package--PMTK (probabilistic modeling toolkit)--that is freely available online. The book is suitable for upper-level undergraduates with an introductory-level college math background and beginning graduate students.
---
paper_title: Comparison of BPL and RBF network in intrusion detection system

paper_content:

In this paper, we present the performance comparison results of the backpropagation learning (BPL) algorithm in a multilayer perceptron (MLP) neural network and the radial basis functions (RBF) network for intrusion detection. The results show that RBF network improves the performance of intrusion detection systems (IDSs) in anomaly detection with a high detection rate and a low false positive rate. RBF network requires less training time and can be optimized to balance the detection and the false positive rates.
---
paper_title: Comparison of Machine Learning algorithms performance in detecting network intrusion

paper_content:

Organization has come to realize that network security technology has become very important in protecting its information. With tremendous growth of internet, attack cases are increasing each day along with the modern attack method. One of the solutions to this problem is by using Intrusion Detection System (IDS). Machine Learning is one of the methods used in the IDS. In recent years, Machine Learning Intrusion Detection system has been giving high accuracy and good detection on novel attacks. In this paper the performance of a Machine Learning algorithm called Decision Tree (J48) is evaluated and compared with two other Machine Learning algorithms namely Neural Network and Support Vector Machines which has been conducted by A. Osareh [1] for detecting intrusion. The algorithms were tested based on accuracy, detection rate, false alarm rate and accuracy of four categories of attacks. From the experiments conducted, it was found that the Decision tree (J48) algorithm outperformed the other two algorithms.
---
paper_title: Intrusion Detection Based on RBF Neural Network

paper_content:

Radial Basis Function (RBF) has been one of the most common neural networks used in the intrusion detection system(IDS). To improve the approximation performance and calculation speed of RBF, we describe a method to deal with the benchmark datasets adopted in the research. It includes converting the string to numeric elements firstly, then omitting the unnecessary data and ensuring that the data has the reasonable range limit. The simulation results built upon Matlab software show that the RBF neural network has better performance than BP neural network.
---
paper_title: Machine Learning in Wireless Sensor Networks: Algorithms, Strategies, and Applications

paper_content:

Wireless sensor networks (WSNs) monitor dynamic environments that change rapidly over time. This dynamic behavior is either caused by external factors or initiated by the system designers themselves. To adapt to such conditions, sensor networks often adopt machine learning techniques to eliminate the need for unnecessary redesign. Machine learning also inspires many practical solutions that maximize resource utilization and prolong the lifespan of the network. In this paper, we present an extensive literature review over the period 2002–2013 of machine learning methods that were used to address common issues in WSNs. The advantages and disadvantages of each proposed algorithm are evaluated against the corresponding problem. We also provide a comparative guide to aid WSN designers in developing suitable machine learning solutions for their specific application challenges.
---
paper_title: The use of computational intelligence in intrusion detection systems : A review

paper_content:

Intrusion detection based upon computational intelligence is currently attracting considerable interest from the research community. Characteristics of computational intelligence (CI) systems, such as adaptation, fault tolerance, high computational speed and error resilience in the face of noisy information, fit the requirements of building a good intrusion detection model. Here we want to provide an overview of the research progress in applying CI methods to the problem of intrusion detection. The scope of this review will encompass core methods of CI, including artificial neural networks, fuzzy systems, evolutionary computation, artificial immune systems, swarm intelligence, and soft computing. The research contributions in each field are systematically summarized and compared, allowing us to clearly define existing research challenges, and to highlight promising new research directions. The findings of this review should provide useful insights into the current IDS literature and be a good source for anyone who is interested in the application of CI approaches to IDSs or related fields.
---
paper_title: Training MLP neural network to reduce false alerts in IDS

paper_content:

Due to the tremendous growth of the Internet and Network based services, the severity of network based computer attacks have significantly increased. Thus, IDS play a vital role in network security. Intrusion detection system tries to detect computer attacks by examining various data records, log audits etc. Many existing IDS such as Snort are signature based system. The problem with such a system is that it cannot detect novel attacks whose signature is not available and hence generates a high rate of alerts. In this paper Multilayer Perceptron (MLP) with Back-Propagation algorithm is used to classify attacks. We train and test MLP with KDD99 training dataset. We use KDD99 dataset which is a subset of the DARPA dataset. It is a preprocessed dataset and is most suitable for our system. We analyze the working of MLP by performing various experiments. We observed that MLP Neural network requires large training time. Once it trained, detects known as well as unknown attacks and also reduces false alerts.
---
paper_title: RBF-based real-time hierarchical intrusion detection systems

paper_content:

An intrusion detection system (IDS) is an art to detect network intrusions by monitoring the network traffic patterns. Generally, an IDS uses only a single-layer detection structure; therefore it cannot adjust its structure adaptively and automatically. In this paper, two hierarchical IDSs, the serial hierarchical and parallel hierarchical IDSs, are proposed. Both of them are based on radial basis function (RBF) neural networks. Because of the short training time and high accuracy of the RBF neural networks, two hierarchical IDSs can monitor network traffic in real-time, train new classifiers for novel intrusions automatically, and modify their structures adaptively after new classifiers are trained.
---
paper_title: Machine Learning: A Probabilistic Perspective

paper_content:

Today's Web-enabled deluge of electronic data calls for automated methods of data analysis. Machine learning provides these, developing methods that can automatically detect patterns in data and then use the uncovered patterns to predict future data. This textbook offers a comprehensive and self-contained introduction to the field of machine learning, based on a unified, probabilistic approach. The coverage combines breadth and depth, offering necessary background material on such topics as probability, optimization, and linear algebra as well as discussion of recent developments in the field, including conditional random fields, L1 regularization, and deep learning. The book is written in an informal, accessible style, complete with pseudo-code for the most important algorithms. All topics are copiously illustrated with color images and worked examples drawn from such application domains as biology, text processing, computer vision, and robotics. Rather than providing a cookbook of different heuristic methods, the book stresses a principled model-based approach, often using the language of graphical models to specify models in a concise and intuitive way. Almost all the models described have been implemented in a MATLAB software package--PMTK (probabilistic modeling toolkit)--that is freely available online. The book is suitable for upper-level undergraduates with an introductory-level college math background and beginning graduate students.
---
paper_title: Intrusion detection technique by using fuzzy ART on computer network security

paper_content:

the problem of computer network security is the very hard of detecting new attacks which do not have known signatures of intrusion. Intrusion Detection Systems (IDS) is a program of monitoring the events in a computer network and analyzing them for signature of intrusions. This paper proposed the clustering technique by using hybrid method based on Principal Component Analysis (PCA) and Fuzzy Adaptive Resonance Theory (FART) for identifying various attacks. The PCA is applied to random selects the best attribution and reduction the feature space. FART is implementing used to classifying difference group of data, Normal and Anomalous. The results show that the proposed technique can improve the high performance of the detection rate and to minimize the false alarm rate. The evaluated our approach on the benchmark data from KDDCup'99 data set.
---
paper_title: Intrusion detection in MANET using Self Organizing Map (SOM)

paper_content:

Mobile Ad-hoc networks (MANET) are formed with dynamism and upheld by individual hosts in a network. In these type of networks all communication occurs through a wireless medium and the nature of the network is decentralized and dynamic. Hence it probes for a number of security problems and in order provide security against malicious attacks, Intrusion Detection System (IDS) is commonly used as a second route of protection in MANET. Intrusion detection models are used to detect the attacks based on the patterns and alerts in case of intruders are being met with the system. In this paper, we propose and implement intrusion-detection system grounded on artificial neural network model such as Self-Organizing Map (SOM) based competitive network, which in turn plays a vital role in detection of malicious nodes based on input data patterns. The proposed model deals with different types of attacks and their detection approach based on SOM model. The approach aids at increasing Detection rate as well as reducing the False alarm rate, which in turn helps to detect those attacks before it makes larger damage to the network and prevent them with supportive techniques and increase the network performance. The experimental results of proposed model is evaluated under different parameters.
---
paper_title: Study of Neural Network Technologies in Intrusion Detection Systems

paper_content:

In recent years, the network attack become more and more widespread and difficult in against. Intrusion Detection is a major focus of research in network security. This paper analyzes Neural Network (NN) methods being used in IDS, in which five different types of NNs are described: multilayer perceptrons (MLP), radial basis function (RBF), self-organizing feature map (SOFM), adaptive resonance theory (ART) and principal component analysis (PCA). An intrusion detection system combined with Genetic Algorithm (GA) and Back Propagation (BP) network is presented. Finally, a discussion of the future NN technologies, which guarantee to enhance the detection efficiency of IDS is provided.
---
paper_title: Designing a technique for detecting intrusion based on modified Adaptive Resonance Theory Network

paper_content:

Detecting intrusion is an important activity in the solution finding algorithms. Artificial Neural Networks can be employed for the detection of intrusion. This paper discusses a technique for detecting intrusion by modified ART network (Adaptive Resonance Theory Network). The various states associated with an event are processed to frame a basic model for detection. The probabilities associated with these states are utilized to define a mathematical function. This function determines or evaluates the performance of the system. The basic ART network is modified using the decisions based on derivative this function. The design of modified ART networks is described. Thus this paper shows the effectiveness of modified ART network in detecting intrusion.
---
paper_title: The use of computational intelligence in intrusion detection systems : A review

paper_content:

Intrusion detection based upon computational intelligence is currently attracting considerable interest from the research community. Characteristics of computational intelligence (CI) systems, such as adaptation, fault tolerance, high computational speed and error resilience in the face of noisy information, fit the requirements of building a good intrusion detection model. Here we want to provide an overview of the research progress in applying CI methods to the problem of intrusion detection. The scope of this review will encompass core methods of CI, including artificial neural networks, fuzzy systems, evolutionary computation, artificial immune systems, swarm intelligence, and soft computing. The research contributions in each field are systematically summarized and compared, allowing us to clearly define existing research challenges, and to highlight promising new research directions. The findings of this review should provide useful insights into the current IDS literature and be a good source for anyone who is interested in the application of CI approaches to IDSs or related fields.
---
paper_title: Evaluating neural network intrusion detection approaches using Analytic Hierarchy Process

paper_content:

At present age, security in computer and network systems is a pressing concern because a solo attack may cause an immense destruction in computer and network systems. Various intrusion detection approaches be present to resolve this serious issue but the dilemma is which one is more appropriate in the field of intrusion. Therefore, in this paper, we evaluated and compared different neural network (NN) approaches to intrusion detection. This work describes the concepts, tool and methodology being used for assay of different NN intrusion detection approaches using Analytic Hierarchy Process (AHP). Further, conclusion on results is made and direction for future works is presented. The outcome of this work may help and guide the security implementers in two possible ways, either by using the results directly obtained in this paper or by extracting the results using similar mechanism but on different intrusion detection systems or approaches.
---
paper_title: Unsupervised Learning of Distributions on Binary Vectors Using Two Layer Networks

paper_content:

We present a distribution model for binary vectors, called the influence combination model and show how this model can be used as the basis for unsupervised learning algorithms for feature selection. The model can be represented by a particular type of Boltzmann machine with a bipartite graph structure that we call the combination machine. This machine is closely related to the Harmonium model defined by Smolensky. In the first part of the paper we analyze properties of this distribution representation scheme. We show that arbitrary distributions of binary vectors can be approximated by the combination model. We show how the weight vectors in the model can be interpreted as high order correlation patterns among the input bits, and how the combination machine can be used as a mechanism for detecting these patterns. We compare the combination model with the mixture model and with principle component analysis. In the second part of the paper we present two algorithms for learning the combination model from examples. The first learning algorithm is the standard gradient ascent heuristic for computing maximum likelihood estimates for the parameters of the model. Here we give a closed form for this gradient that is significantly easier to compute than the corresponding gradient for the general Boltzmann machine. The second learning algorithm is a greedy method that creates the hidden units and computes their weights one at a time. This method is a variant of projection pursuit density estimation. In the third part of the paper we give experimental results for these learning methods on synthetic data and on natural data of handwritten digit images.
---
paper_title: A Fast Learning Algorithm for Deep Belief Nets

paper_content:

We show how to use "complementary priors" to eliminate the explaining-away effects that make inference difficult in densely connected belief nets that have many hidden layers. Using complementary priors, we derive a fast, greedy algorithm that can learn deep, directed belief networks one layer at a time, provided the top two layers form an undirected associative memory. The fast, greedy algorithm is used to initialize a slower learning procedure that fine-tunes the weights using a contrastive version of the wake-sleep algorithm. After fine-tuning, a network with three hidden layers forms a very good generative model of the joint distribution of handwritten digit images and their labels. This generative model gives better digit classification than the best discriminative learning algorithms. The low-dimensional manifolds on which the digits lie are modeled by long ravines in the free-energy landscape of the top-level associative memory, and it is easy to explore these ravines by using the directed connections to display what the associative memory has in mind.
---
paper_title: Machine Learning: A Probabilistic Perspective

paper_content:

Today's Web-enabled deluge of electronic data calls for automated methods of data analysis. Machine learning provides these, developing methods that can automatically detect patterns in data and then use the uncovered patterns to predict future data. This textbook offers a comprehensive and self-contained introduction to the field of machine learning, based on a unified, probabilistic approach. The coverage combines breadth and depth, offering necessary background material on such topics as probability, optimization, and linear algebra as well as discussion of recent developments in the field, including conditional random fields, L1 regularization, and deep learning. The book is written in an informal, accessible style, complete with pseudo-code for the most important algorithms. All topics are copiously illustrated with color images and worked examples drawn from such application domains as biology, text processing, computer vision, and robotics. Rather than providing a cookbook of different heuristic methods, the book stresses a principled model-based approach, often using the language of graphical models to specify models in a concise and intuitive way. Almost all the models described have been implemented in a MATLAB software package--PMTK (probabilistic modeling toolkit)--that is freely available online. The book is suitable for upper-level undergraduates with an introductory-level college math background and beginning graduate students.
---
paper_title: Learning in graphical models

paper_content:

Part 1 Inference: introduction to inference for Bayesian networks, Robert Cowell advanced inference in Bayesian networks, Robert Cowell inference in Bayesian networks using nested junction trees, Uffe Kjoerulff bucket elimination - a unifying framework for probabilistic inference, R. Dechter an introduction to variational methods for graphical models, Michael I. Jordan et al improving the mean field approximation via the use of mixture distributions, Tommi S. Jaakkola and Michael I. Jordan introduction to Monte Carlo methods, D.J.C. MacKay suppressing random walls in Markov chain Monte Carlo using ordered overrelaxation, Radford M. Neal. Part 2 Independence: chain graphs and symmetric associations, Thomas S. Richardson the multiinformation function as a tool for measuring stochastic dependence, M. Studeny and J. Vejnarova. Part 3 Foundations for learning: a tutorial on learning with Bayesian networks, David Heckerman a view of the EM algorithm that justifies incremental, sparse and other variants, Radford M. Neal and Geoffrey E. Hinton. Part 4 Learning from data: latent variable models, Christopher M. Bishop stochastic algorithms for exploratory data analysis - data clustering and data visualization, Joachim M. Buhmann learning Bayesian networks with local structure, Nir Friedman and Moises Goldszmidt asymptotic model selection for directed networks with hidden variables, Dan Geiger et al a hierarchical community of experts, Geoffrey E. Hinton et al an information-theoretic analysis of hard and soft assignment methods for clustering, Michael J. Kearns et al learning hybrid Bayesian networks from data, Stefano Monti and Gregory F. Cooper a mean field learning algorithm for unsupervised neural networks, Lawrence Saul and Michael Jordan edge exclusion tests for graphical Gaussian models, Peter W.F. Smith and Joe Whittaker hepatitis B - a case study in MCMC, D.J. Spiegelhalter et al prediction with Gaussian processes - from linear regression to linear prediction and beyond, C.K.I. Williams.
---
paper_title: A tutorial survey of architectures, algorithms, and applications for deep learning

paper_content:

In this invited paper, my overview material on the same topic as presented in the plenary overview session of APSIPA-2011 and the tutorial material presented in the same conference [1] are expanded and updated to include more recent developments in deep learning. The previous and the updated materials cover both theory and applications, and analyze its future directions. The goal of this tutorial survey is to introduce the emerging area of deep learning or hierarchical learning to the APSIPA community. Deep learning refers to a class of machine learning techniques, developed largely since 2006, where many stages of non-linear information processing in hierarchical architectures are exploited for pattern classification and for feature learning. In the more recent literature, it is also connected to representation learning, which involves a hierarchy of features or concepts where higher-level concepts are defined from lower-level ones and where the same lower-level concepts help to define higher-level ones. In this tutorial survey, a brief history of deep learning research is discussed first. Then, a classificatory scheme is developed to analyze and summarize major work reported in the recent deep learning literature. Using this scheme, I provide a taxonomy-oriented survey on the existing deep architectures and algorithms in the literature, and categorize them into three classes: generative, discriminative, and hybrid. Three representative deep architectures – deep autoencoders, deep stacking networks with their generalization to the temporal domain (recurrent networks), and deep neural networks (pretrained with deep belief networks) – one in each of the three classes, are presented in more detail. Next, selected applications of deep learning are reviewed in broad areas of signal and information processing including audio/speech, image/vision, multimodality, language modeling, natural language processing, and information retrieval. Finally, future directions of deep learning are discussed and analyzed.
---
paper_title: Long Short Term Memory Recurrent Neural Network Classifier for Intrusion Detection

paper_content:

Due to the advance of information and communication techniques, sharing information through online has been increased. And this leads to creating the new added value. As a result, various online services were created. However, as increasing connection points to the internet, the threats of cyber security have also been increasing. Intrusion detection system(IDS) is one of the important security issues today. In this paper, we construct an IDS model with deep learning approach. We apply Long Short Term Memory(LSTM) architecture to a Recurrent Neural Network(RNN) and train the IDS model using KDD Cup 1999 dataset. Through the performance test, we confirm that the deep learning approach is effective for IDS.
---
paper_title: Scalable Intrusion Detection with Recurrent Neural Networks

paper_content:

The ever-growing use of the Internet comes with a surging escalation of communication and data access. Most existing intrusion detection systems have assumed the one-size-fits-all solution model. Such IDS is not as economically sustainable for all organizations. Furthermore, studies have found that Recurrent Neural Network out-performs Feed-forward Neural Network, and Elman Network. This paper, therefore, proposes a scalable application-based model for detecting attacks in a communication network using recurrent neural network architecture. Its suitability for online real-time applications and its ability to self-adjust to changes in its input environment cannot be over-emphasized.
---
paper_title: Machine Learning: A Probabilistic Perspective

paper_content:

Today's Web-enabled deluge of electronic data calls for automated methods of data analysis. Machine learning provides these, developing methods that can automatically detect patterns in data and then use the uncovered patterns to predict future data. This textbook offers a comprehensive and self-contained introduction to the field of machine learning, based on a unified, probabilistic approach. The coverage combines breadth and depth, offering necessary background material on such topics as probability, optimization, and linear algebra as well as discussion of recent developments in the field, including conditional random fields, L1 regularization, and deep learning. The book is written in an informal, accessible style, complete with pseudo-code for the most important algorithms. All topics are copiously illustrated with color images and worked examples drawn from such application domains as biology, text processing, computer vision, and robotics. Rather than providing a cookbook of different heuristic methods, the book stresses a principled model-based approach, often using the language of graphical models to specify models in a concise and intuitive way. Almost all the models described have been implemented in a MATLAB software package--PMTK (probabilistic modeling toolkit)--that is freely available online. The book is suitable for upper-level undergraduates with an introductory-level college math background and beginning graduate students.
---
paper_title: Network anomaly detection with the restricted Boltzmann machine

paper_content:

With the rapid growth and the increasing complexity of network infrastructures and the evolution of attacks, identifying and preventing network abuses is getting more and more strategic to ensure an adequate degree of protection from both external and internal menaces. In this scenario many techniques are emerging for inspecting network traffic and discriminating between anomalous and normal behaviors to detect undesired or suspicious activities. Unfortunately, the concept of normal or abnormal network behavior depends on several factors and its recognition requires the availability of a model aiming at characterizing current behavior, based on a statistical idealization of past events. There are two main challenges when generating the training data needed for effective modeling. First, network traffic is very complex and unpredictable, and second, the model is subject to changes over time, since anomalies are continuously evolving. As attack techniques and patterns change, previously gained information about how to tell them apart from normal traffic may be no longer valid. Thus, a desirable characteristic of an effective model for network anomaly detection is its ability to adapt to change and to generalize its behavior to multiple different network environments. In other words, a self-learning system is needed. This suggests the adoption of machine learning techniques to implement semi-supervised anomaly detection systems where the classifier is trained with ''normal'' traffic data only, so that knowledge about anomalous behaviors can be constructed and evolve in a dynamic way. For this purpose we explored the effectiveness of a detection approach based on machine learning, using the Discriminative Restricted Boltzmann Machine to combine the expressive power of generative models with good classification accuracy capabilities to infer part of its knowledge from incomplete training data.
---
paper_title: A tutorial survey of architectures, algorithms, and applications for deep learning

paper_content:

In this invited paper, my overview material on the same topic as presented in the plenary overview session of APSIPA-2011 and the tutorial material presented in the same conference [1] are expanded and updated to include more recent developments in deep learning. The previous and the updated materials cover both theory and applications, and analyze its future directions. The goal of this tutorial survey is to introduce the emerging area of deep learning or hierarchical learning to the APSIPA community. Deep learning refers to a class of machine learning techniques, developed largely since 2006, where many stages of non-linear information processing in hierarchical architectures are exploited for pattern classification and for feature learning. In the more recent literature, it is also connected to representation learning, which involves a hierarchy of features or concepts where higher-level concepts are defined from lower-level ones and where the same lower-level concepts help to define higher-level ones. In this tutorial survey, a brief history of deep learning research is discussed first. Then, a classificatory scheme is developed to analyze and summarize major work reported in the recent deep learning literature. Using this scheme, I provide a taxonomy-oriented survey on the existing deep architectures and algorithms in the literature, and categorize them into three classes: generative, discriminative, and hybrid. Three representative deep architectures – deep autoencoders, deep stacking networks with their generalization to the temporal domain (recurrent networks), and deep neural networks (pretrained with deep belief networks) – one in each of the three classes, are presented in more detail. Next, selected applications of deep learning are reviewed in broad areas of signal and information processing including audio/speech, image/vision, multimodality, language modeling, natural language processing, and information retrieval. Finally, future directions of deep learning are discussed and analyzed.
---
paper_title: Intrusion detection using deep belief networks

paper_content:

With the advent of digital technology, security threats for computer networks have increased dramatically over the last decade being much bolder and brazen. There is a great need for an effective Intrusion Detection System (IDS) which are intelligent specialized system designed to interpret the intrusion attempts in incoming network traffic. Deep belief neural (DBN) networks proved to be the most influential deep neural nets and generative neural networks that stack Restricted Boltzmann Machines. In this paper, we explore the capabilities of DBN's performing intrusion detection through series of experiments after training it with NSL-KDD dataset. The trained DBN network now identifies any kind of unknown attack in dataset supplied to it and to the best of our knowledge this is first comprehensive paper performing intrusion detection using deep belief nets. The proposed system not only detect attacks but also classify them in five groups with the accuracy of identifying and classifying network activity based on limited, incomplete, and nonlinear data sources. The proposed system achieved detection accuracy about 97.5% for only fifty iterations that is state of art performance compare to the existing system till today for intrusion detection.
---
paper_title: An Intrusion Detection Model Based on Deep Belief Networks

paper_content:

This paper focuses on an important research problem of Big Data classification in intrusion detection system. Deep Belief Networks is introduced to the field of intrusion detection, and an intrusion detection model based on Deep Belief Networks is proposed to apply in intrusion recognition domain. The deep hierarchical model is a deep neural network classifier of a combination of multilayer unsupervised learning networks, which is called as Restricted Boltzmann Machine, and a supervised learning network, which is called as Back-propagation network. The experimental results on KDD CUP 1999 dataset demonstrate that the performance of Deep Belief Networks model is better than that of SVM and ANN.
---
paper_title: Nonlinear dimensionality reduction for intrusion detection using auto-encoder bottleneck features

paper_content:

The continuous advances in technology is the reason of integration of our lives and information systems. Due to this fact the importance of security in these systems increases. Therefore, the application of intrusion detection systems as security solutions is increasing year by year. These systems (IDSs) are considered as a way of protection against cyber-attacks. However, handling big data constitutes one of the main challenges of intrusion detection systems and is the reason of low performance of these systems from the view of time and space complexity. To address these problems we have proposed an approach to reduce this complexity. Our approach is based on dimensionality reduction and the neural network bottleneck feature extraction is considered as the main method in this research. We have conducted several experiments on a benchmark dataset (NSL-KDD) to investigate the effectiveness of our approach. The results show that our approach is promising in terms of accuracy for real-world intrusion detection.
---
paper_title: Deep Boltzmann machines

paper_content:

We present a new learning algorithm for Boltzmann machines that contain many layers of hidden variables. Data-dependent expectations are estimated using a variational approximation that tends to focus on a single mode, and dataindependent expectations are approximated using persistent Markov chains. The use of two quite different techniques for estimating the two types of expectation that enter into the gradient of the log-likelihood makes it practical to learn Boltzmann machines with multiple hidden layers and millions of parameters. The learning can be made more efficient by using a layer-by-layer “pre-training” phase that allows variational inference to be initialized with a single bottomup pass. We present results on the MNIST and NORB datasets showing that deep Boltzmann machines learn good generative models and perform well on handwritten digit and visual object recognition tasks.
---
paper_title: A tutorial survey of architectures, algorithms, and applications for deep learning

paper_content:

In this invited paper, my overview material on the same topic as presented in the plenary overview session of APSIPA-2011 and the tutorial material presented in the same conference [1] are expanded and updated to include more recent developments in deep learning. The previous and the updated materials cover both theory and applications, and analyze its future directions. The goal of this tutorial survey is to introduce the emerging area of deep learning or hierarchical learning to the APSIPA community. Deep learning refers to a class of machine learning techniques, developed largely since 2006, where many stages of non-linear information processing in hierarchical architectures are exploited for pattern classification and for feature learning. In the more recent literature, it is also connected to representation learning, which involves a hierarchy of features or concepts where higher-level concepts are defined from lower-level ones and where the same lower-level concepts help to define higher-level ones. In this tutorial survey, a brief history of deep learning research is discussed first. Then, a classificatory scheme is developed to analyze and summarize major work reported in the recent deep learning literature. Using this scheme, I provide a taxonomy-oriented survey on the existing deep architectures and algorithms in the literature, and categorize them into three classes: generative, discriminative, and hybrid. Three representative deep architectures – deep autoencoders, deep stacking networks with their generalization to the temporal domain (recurrent networks), and deep neural networks (pretrained with deep belief networks) – one in each of the three classes, are presented in more detail. Next, selected applications of deep learning are reviewed in broad areas of signal and information processing including audio/speech, image/vision, multimodality, language modeling, natural language processing, and information retrieval. Finally, future directions of deep learning are discussed and analyzed.
---
paper_title: Learning invariant feature hierarchies

paper_content:

Fast visual recognition in the mammalian cortex seems to be a hierarchical process by which the representation of the visual world is transformed in multiple stages from low-level retinotopic features to high-level, global and invariant features, and to object categories. Every single step in this hierarchy seems to be subject to learning. How does the visual cortex learn such hierarchical representations by just looking at the world? How could computers learn such representations from data? Computer vision models that are weakly inspired by the visual cortex will be described. A number of unsupervised learning algorithms to train these models will be presented, which are based on the sparse auto-encoder concept. The effectiveness of these algorithms for learning invariant feature hierarchies will be demonstrated with a number of practical tasks such as scene parsing, pedestrian detection, and object classification.
---
paper_title: Deep learning

paper_content:

Deep learning is a form of machine learning that enables computers to learn from experience and understand the world in terms of a hierarchy of concepts. Because the computer gathers knowledge from experience, there is no need for a human computer operator to formally specify all the knowledge that the computer needs. The hierarchy of concepts allows the computer to learn complicated concepts by building them out of simpler ones; a graph of these hierarchies would be many layers deep. This book introduces a broad range of topics in deep learning. The text offers mathematical and conceptual background, covering relevant concepts in linear algebra, probability theory and information theory, numerical computation, and machine learning. It describes deep learning techniques used by practitioners in industry, including deep feedforward networks, regularization, optimization algorithms, convolutional networks, sequence modeling, and practical methodology; and it surveys such applications as natural language processing, speech recognition, computer vision, online recommendation systems, bioinformatics, and videogames. Finally, the book offers research perspectives, covering such theoretical topics as linear factor models, autoencoders, representation learning, structured probabilistic models, Monte Carlo methods, the partition function, approximate inference, and deep generative models. Deep Learning can be used by undergraduate or graduate students planning careers in either industry or research, and by software engineers who want to begin using deep learning in their products or platforms. A website offers supplementary material for both readers and instructors.
---

Title: Shallow and Deep Networks Intrusion Detection System: A Taxonomy and Survey

Section 1: INTRODUCTION
Description 1: This section introduces the rapid development of computer networks, the importance of network security, and provides an overview of Intrusion Detection Systems (IDSs) and their evolution. It also highlights the challenges faced by IDS in terms of false positives, detection accuracy, and their dependency on known attack signatures. The section concludes with the objectives of this paper, which are to describe and classify IDSs using machine learning techniques as well as to compare shallow and deep network-based IDSs.

Section 2: INTRUSION DETECTION SYSTEMS
Description 2: This section provides an in-depth overview of the functioning, placement, and importance of Intrusion Detection Systems (IDSs). It discusses the different sources of data for IDSs (host-based and network-based) and categorizes various detection techniques into anomaly-based and signature-based detection.

Section 3: Host Based IDS (HIDS) Vs. Network Based IDS (NIDS)
Description 3: This section contrasts Host-Based Intrusion Detection Systems (HIDS), which are installed on individual host computers, with Network-Based Intrusion Detection Systems (NIDS), which monitor network traffic. It discusses the advantages and disadvantages of both approaches.

Section 4: Anomaly Based Detection
Description 4: This section explains anomaly-based detection systems that identify intrusions by looking for deviations from normal behavior profiles. It categorizes anomaly detection systems into self-learning and programmed models and describes various techniques like time series models, threshold models, and statistical models used for anomaly detection.

Section 5: Signature Based Detection
Description 5: This section covers signature-based detection systems, which use predefined rules and patterns to identify known attacks. It discusses different programming techniques such as state modeling, expert systems, and string matching.

Section 6: MACHINE LEARNING TECHNIQUES
Description 6: This section reviews various machine learning techniques used for anomaly detection in IDS, emphasizing the importance of feature selection in the classification process. It covers a range of machine learning methods including Bayesian networks, Genetic Algorithms (GA), Support Vector Machines (SVM), K-Nearest Neighbour (K-NN), Decision Tree (DT), Fuzzy Logic (FL), and clustering algorithms.

Section 7: Analytical Comparison of ML Techniques
Description 7: This section provides an analytical comparison of the discussed machine learning techniques, highlighting their respective advantages and disadvantages in terms of accuracy, performance, and computational requirements.

Section 8: Artificial Neural Network and Deep Networks IDS
Description 8: This section delves into the use of Artificial Neural Networks (ANN) and deep learning techniques for intrusion detection. It covers both supervised and unsupervised learning methods, types of neural networks such as Multilayer Perceptron (MLP) and Radial Basis Function (RBF), and compares their performance.

Section 9: Deep Networks
Description 9: This section discusses deep network architectures and their application in intrusion detection, including generative and discriminative models. It explores structures such as Recurrent Neural Networks (RNN), Deep Auto-Encoders, Deep Boltzmann Machines (DBM), and Deep Belief Networks (DBN).

Section 10: Conclusion
Description 10: This section summarizes the paper's findings, emphasizing the performance and potential of deep networks in intrusion detection systems compared to shallow networks. It also discusses the ongoing research efforts and future directions in enhancing the reliability and efficiency of IDSs using advanced machine learning and deep learning techniques.