期刊
EXPERT SYSTEMS WITH APPLICATIONS
卷 213, 期 -, 页码 -出版社
PERGAMON-ELSEVIER SCIENCE LTD
DOI: 10.1016/j.eswa.2022.119030
关键词
Gradient boosting tree; Intrusion detection; Anomaly detection; Bagging; Dual ensemble
This study introduces a dual ensemble model for anomaly-based intrusion detection systems, which combines bagging and gradient boosting decision tree (GBDT) techniques. The evaluation using multiple publicly available data sets shows that the proposed technique not only improves the detection rate and reduces the false alarm rate but also outperforms other similar techniques reported in the literature.
The mission of an intrusion detection system (IDS) is to monitor network activities and assess whether or not they are malevolent. Specifically, anomaly-based IDS can discover irregular activities by discriminating between normal and anomalous deviations. Nonetheless, existing strategies for detecting anomalies generally rely on single classification models that are still incapable of reducing the false alarm rate and increasing the detection rate. This study introduces a dual ensemble model by combining two existing ensemble techniques, such as bagging and gradient boosting decision tree (GBDT). Multiple dual ensemble schemes involving various fine-tuned GBDT algorithms such as gradient boosting machine (GBM), LightGBM, CatBoost, and XGBoost, are extensively appraised using multiple publicly available data sets, such as NSL-KDD, UNSW-NB15, and HIKARI-2021. The results indicate that the proposed technique is a reasonable solution for the anomaly-based IDS task. Furthermore, we demonstrate that the combination of Bagging and GBM is superior to all alternative combination schemes. In addition, the proposed dual ensemble (e.g., Bagging-GBM) is considerably more competitive than similar techniques reported in the current literature.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据