CH-SVM Based Network Anomaly Detection

• Main Authors: Xue-Qin Zhang, Chun-Hua Gu
• Format: Conference Proceeding
• Language: English
• Subjects: Anomaly detection; Computer networks; Convex hull; Cybernetics; Intrusion detection; Large-scale systems; Machine learning; Quadratic programming; Statistical learning; Support vector machine; Support vector machine classification; Support vector machines; Telecommunication traffic
• ISSN: 2160-133X
• DOI: 10.1109/ICMLC.2007.4370710

Network anomaly detection is a critical task to ensure network security. With increasing network traffic, detecting network anomaly would require solving a large-scale pattern classification problem that often contains millions of training vectors. Each training vector may represent a particular signature of network traffic pattern and some of them may be linked to security breaching activities that need to be detected and eradicated. In this paper, a popular statistical learning algorithm known as the support vector machine (SVM) was consider to solve the network anomaly detection problem. However, it is well known that SVM would require excessively long computing time and exceedingly large amount of memory when number of training vectors becomes huge. Hence, direct application of the standard SVM algorithm to solve large-scale network anomaly detection problems is impractical. In this paper, based on computational geometry theory, a new algorithm called convex-hull SVM (CH-SVM) was proposed, which can yield the same solution as original SVM while using significantly less training data, and hence less computing time. Then experiments were done on KDD'99 intrusion detection dataset to compare the performance of the proposed algorithm to a standard SVM and observed reduced training time and improved classification accuracy.