AdaBoost-Based Algorithm for Network Intrusion Detection

TLDR

Network intrusion detection distinguishes attacks from normal traffic and is essential for security, but the diversity of behaviors and evolving attack tactics demand fast machine‑learning algorithms with high detection rates and low false‑alarm rates. The authors propose an AdaBoost‑based intrusion detection algorithm. The algorithm uses AdaBoost with decision‑stump weak classifiers for both categorical and continuous features, combines them into a strong classifier that naturally handles mixed feature types, and employs adaptable initial weights and an over‑fitting avoidance strategy to improve performance. Experiments on benchmark data demonstrate that the algorithm achieves low computational complexity and error rates compared to more complex methods.

Abstract

Network intrusion detection aims at distinguishing the attacks on the Internet from normal use of the Internet. It is an indispensable part of the information security system. Due to the variety of network behaviors and the rapid development of attack fashions, it is necessary to develop fast machine-learning-based intrusion detection algorithms with high detection rates and low false-alarm rates. In this correspondence, we propose an intrusion detection algorithm based on the AdaBoost algorithm. In the algorithm, decision stumps are used as weak classifiers. The decision rules are provided for both categorical and continuous features. By combining the weak classifiers for continuous features and the weak classifiers for categorical features into a strong classifier, the relations between these two different types of features are handled naturally, without any forced conversions between continuous and categorical features. Adaptable initial weights and a simple strategy for avoiding overfitting are adopted to improve the performance of the algorithm. Experimental results show that our algorithm has low computational complexity and error rates, as compared with algorithms of higher computational complexity, as tested on the benchmark sample data.