Intrusion Detection System with Dynamic Training Model

Intrusion detection relies on the extensive knowledge of security experts, particularly, on their familiarity with the computer systems to be protected. To reduce this dependency, various machine learning techniques and data mining techniques have been deployed for intrusion detection. An IDS is usually deployed in a dynamically changing environment, which requires continuous training of the intrusion detection model, in order to sustain sufficient performance. The manual training process carried out in the current systems depends on the system administrators in working out the training solution and in integrating it into the intrusion detection model.

In this paper, an automatically training IDS is proposed which will automatically train the detection model on-the-fly according to the feedback provided by operators when false predictions are encountered. The proposed system is evaluated using the KDDCup’99 intrusion detection dataset. Experimental results show that the system achieves up to 31% improvement in terms of misclassification cost when compared with a system lacking the tuning feature. If only 12% false predictions are used to train the model, the system still achieves about 32% improvement. Administrators can focus on verification of predictions with low confidence level, as only those predictions determined to be false will be used to train the detection model.