An Ensemble of Gaussian Mixture Model and Support Vector Machines for Network Intrusion Detection

Abstract

NetworkIntrusion Detection Systems (NIDS) can protect computer networks and computersystems by detecting abnormal network packets and taking agreed action plans,such as notifying an administrator or rejecting the network packets. In this study,the aim is the implementation of NIDS with improved performance using anensemble of Support Vector Machines (SVMs) and the Gaussian Mixture Model(GMM). Four SVMs with Radial Basis Function (RBF), linear, polynomial, andsigmoid kernel functions, and a GMM were trained with the same portion withKnowledge Discovery and Data Mining Tools Competition (KDD 99) dataset, andanother portion of the dataset was used to evaluate the performance of therespective NIDS models. Finally, the five models were integrated to form an ensembleIntrusion Detection System (IDS) model and the same test dataset was used tovalidate its performance. The IDS model of SVM with RBF kernel function has thebest performance with precision, recall, f1score, accuracy, false acceptance rate, and false rejection rate of 99.88,99.67, 99.77, 99.82, 0.08, and 0.33% respectively. The ensemble model built bycombining the five trained models where each of them has equal voting rightsyields state-of-art performance, precision, recall, f1-score, accuracy, falseacceptance rate, and false rejection rate of 99.7, 99.4, 99.55, 99.65, 0.18 and0.59% respectively though it is below the performance of the SVM-RBF and theSVM-polynomial models. Ensemble models are expected to have better performancethan a single classifier, but the result of this research shows that this isnot applicable in all cases as the SVM with RBF kernel outperformed theensemble classifier.