Application of Relevance Vector Machines in Real Time Intrusion Detection

Transcription

1 (IJACSA) Internatonal Journal of Advanced Computer Scence and Applcatons, Applcaton of Relevance Vector Machnes n Real Tme Intruson Detecton Naveen N.C, Assocate Professor, Department of ISE, R V College of Engneerng, Bangalore and Research Scholar, Dept of CSE, SRM Unversty, Chenna, Inda Dr Natarajan.S, Professor, Department of ISE P E S I T, Bangalore, Inda Dr Srnvasan.R, Professor Emertus, Department of Computer Scence and Engneerng, M S R I T, Bangalore, Inda Abstract In the recent years, there has been a growng nterest n the development of change detecton technques for the analyss of Intruson Detecton. Ths nterest stems from the wde range of applcatons n whch change detecton methods can be used. Detectng the changes by observng data collected at dfferent tmes s one of the most mportant applcatons of network securty because they can provde analyss of short nterval on global scale. Research n explorng change detecton technques for medum/hgh network data can be found for the new generaton of very hgh resoluton data. The advent of these technologes has greatly ncreased the ablty to montor and resolve the detals of changes and makes t possble to analyze. At the same tme, they present a new challenge over other technologes n that a relatvely large amount of data must be analyzed and corrected for regstraton and classfcaton errors to dentfy frequently changng trend. In ths research paper an approach for Intruson Detecton System (IDS) whch embeds a Change Detecton Algorthm wth Relevance Vector Machne (RVM) s proposed. IDS are consdered as a complex task that handles a huge amount of network related data wth dfferent parameters. Current research work has proved that kernel learnng based methods are very effectve n addressng these problems. In contrast to Support Vector Machnes (SVM), the RVM provdes a probablstc output whle preservng the accuracy. The focus of ths paper s to model RVM that can work wth large network data set n a real envronment and develop RVM classfer for IDS. The new model conssts of Change Pont (CP) and RVM whch s compettve n processng tme and mprove the classfcaton performance compared to other known classfcaton model lke SVM. The goal s to make the system smple but effcent n detectng network ntruson n an actual real tme envronment. Results show that the model learns more effectvely, automatcally adjust to the changes and adjust the threshold whle mnmzng the false alarm rate wth tmely detecton. Keywords- Intruson Detecton; Change Pont Detecton; Relevance Vector Machne; Outler Detecton. I. INTRODUCTION Reasonable level of securty s provded by statc defense mechansms such as frewalls and software updates. Dynamc mechansms can also be used to acheve securty such as IDS and Network Analyzers (NA). The man dfference between IDS and NA s that IDS ams to acheve the specfc goal of detectng attacks whereas NA ams to determne the changng trends n network of computers [1] [18]. Earler work emphaszed that data can be obtaned by three ways usng real traffc, santzed traffc and smulated traffc. But n real tme fast response wth reduced false postves to external events wthn an extremely short tme s demanded and expected [19]. Therefore, an alternatve algorthm to mplement real tme learnng s mperatve for crtcal applcatons for fast changng envronments. Even for offlne applcatons, speed s stll a need, and a real tme learnng algorthm that reduces tranng tme and human effort to nearly zero would always be of consderable value. Mnng data n real tme s stll a bg challenge [21]. IDS nvolve automatc dentfcaton of unusual actvty by collectng data, and comparng t wth reference data. An assumpton of IDS s that a network s normal behavor s dstnct from abnormal or ntrusve behavor, whch can be a result of varous attack/s. In ths research work, flow analyss s used for network traffc analyss whch searches for behavoral characterstcs n a flow. There are varous characterstcs such as transferred bytes, packets, flow length, nter-arrval tmes, nter-packet gaps, etc that are montored and computed. Data that s collected from flows can be used on hgh-speed networks as there s no deep packet nspecton. In ths paper a hybrd approach for mprovng the performance of detecton algorthm by buldng more ntellgence to the system s proposed. In ths drecton CP detecton s consdered for dscoverng change ponts f propertes of network behavor change. CP s the change n characterstcs that occur very fast wth respect to the samplng perod of the measurements, f not nstantaneously. The detecton of changes refers to tools that help to decde whether such a change has occurred n the characterstcs or not. Outler Detecton s a major step n Data Mnng (DM) problem whch dscovers abnormal or devatng data ponts wth respect to dstrbuton n data [20]. Outlers are often consdered as an error or nose although they may carry very mportant nformaton. A real tme detecton system s one n whch network ntruson detecton happens whle an attack s occurrng. A real tme IDS captures the present network traffc data whch s on lne data. Bayesan learnng algorthms, lke RVM allow the user to specfy a probablty dstrbuton over possble parameter values from the learned classfer. Ths wll provde one soluton to the over fttng problem as the algorthm can use pror dstrbuton to regularze the classfer P a g e

2 (IJACSA) Internatonal Journal of Advanced Computer Scence and Applcatons, II. RELATED WORK Research shows that many Machne Learnng (ML) technques can be used for data classfcaton. It s presented that popular supervsed learnng technques gves hgh detecton accuracy for IDS. A wde range of real world applcatons are dscussed n the communty of Statstcal Analyss and DM [3] [13]. Statstcal technques usually assume an underlyng dstrbuton of data and requre the elmnaton of data nstances contanng nose. Statstcal methods though computatonally ntense can be appled to analyze the data [4]. Statstcal methods are wdely used to buld behavor based IDS. The behavor of the system s measured by a number of varables sampled over tme such as the resource usage duraton, the number of processors, memory dsk resources consumed durng that sesson etc. The model keeps averages of all the varables and detects whether thresholds are exceeded based on the standard devaton of the varable. Very few on lne (real tme) network IDS approaches are proposed untl now. Lao and Vemur [5] develop a real tme IDS usng Self Organzng Maps (SOM) and preprocess ther dataset wth 10 features for each data record contanng nformaton of 50 packets. M. Al-Subae [6] uses Hdden Markov Models over Neural Networks n anomaly ntruson detecton to classfy normal network actvty and attack usng a large tranng dataset. The approach was evaluated by analyzng how t affected the classfcaton results. Ben Amor [7] desgns a real tme IDS usng Naïve Bayes and Decson Trees and the results show that the Nave Bayes gves hgher detecton speed and detecton rate than the Decson Trees. Authors n [8] [14] propose a hybrd ntellgent systems usng Decson Trees (DT), SVM and Fuzzy SVM for anomaly detecton (unknown or new attacks). The results show that the hybrd DT SVM approach mproves the performance for all the classes when compared to a SVM approach. SVM proposed by (Burges 1998, Cortes and Vapnk 1995) s a supervsed learnng algorthm that s used ncreasngly n IDS. The classfcaton performance of SVM model s better than the classfcaton methods, such as ANN [9]. The beneft of SVMs s that they learn very effectvely wth hgh dmensonal data. Rung Chng Chen [10] uses Rough Set Theory (RST) and SVM to detect ntrusons. Intally, RST s used to preprocess the data and reduce the dmensons. Later, the features selected by RST are sent to SVM model to learn and test. Ths method proves to be effectve and also decreased the space densty of data. The SVM s one of the most successful classfcaton algorthms n the DM area [17]. RVM, proposed by Tppng [11] s a sparse machne learnng algorthm that s smlar to the SVM n many respects. It s capable of delverng a fully probablstc output and t s proved to have nearly dentcal performance to, f not better than, that of SVM n several benchmarks. D He [12] proposes an IDS approach based on the RVM where a Chebyshev chaotc map s ntroduced as the nner tranng nose sgnal. The result shows that the approach can reach hgher detecton probabltes under dfferent knds of ntrusons and the computatonal complexty reduces effcently. L Ru [16] mproves the generalzaton performance of RVM by an ncremental relevance vector machne algorthm and the results are better than RVM and SVM. Ths guarantees the relablty of usng RVM based approach for desgnng IDS. RVM has a better generalzaton performance than SVM due to the less support vectors. III. METHODOLOGY Over 90% of Internet traffc uses the Transmsson Control Protocol (TCP). Because of ts wdespread use and ts mpressve growth, the research focuses on the detecton of anomalous behavor wthn TCP traffc. Explorng the TCP packet attrbutes would enable a classfer to dentfy normal and abnormal actvty on a packet-by-packet bass. From these attrbutes, a decson tree s bult whch wll enable to dentfy and classfy dfferent attacks and volatons. The process of buldng a classfer model usng RVM s depcted n Fg. 1. Stage 1 Stage 2 Real Tme Data Traffc Data Data Preprocessng Log Fle CPOD Algorthm Outlers Vector Fgure 1. Archtecture of the model Stage 3 Classfer Inference Usng RVM Log Fle Alarm Unt A. Dataset Descrpton The frst stage of the mplementaton nvolves n tranng the system. For the present problem data s collected from the campus network to measure the accuracy and attacks. Data such collected s preprocessed and used to detect change pont n network performance characterstcs. Traffc n the network results n contnuous change as the user s logn and make use of Internet. For capturng the packets n real tme JPCAP and WINPCAP tool s used to collect the nformaton that s beng transmtted. JPCAP provdes facltes to capture and save raw packets lve. It can automatcally dentfy packet types and can generate correspondng Java objects for Ethernet, IPv4, IPv6, ARP/RARP, TCP, UDP, and ICMPv4 packets. Packets can also be fltered accordng to the user requrement. JPCAP s developed on LIBPCAP / WINPCAP, whch s mplemented n C and Java and s the ndustry-standard tool for lnk-layer network access. In Wndows envronment WINPCAP allows applcatons to capture and transmt network packets bypassng the protocol stack. The network data s collected from the nterface whch s capable of capturng nformaton flowng wthn the local network. For example, anomales can be detected on a sngle machne, a group of network a swtch or a router. For the current research work the TCP/IP packet s collected n real tme from the research lab network and dumped for further process. The Data Preprocessng phase handles the converson of raw packet or connecton data nto a 49 P a g e

3 (IJACSA) Internatonal Journal of Advanced Computer Scence and Applcatons, format that algorthms can utlze and store the results n the knowledge base. Rather than operatng on a raw network dump fle, the algorthm uses summary nformaton to perform the analyss. Data s preprocessed to generate summary lnes about each connecton found n the dump fle. The resultng summary fle s then parsed and processed by the algorthm to gve a count to each data/each tme pont, wth a hgher score ndcatng a hgh possblty of beng an outler/a change pont. The Log Fle stores the data as rules produced by the detecton algorthm for further mnng process. It may also hold nformaton for the preprocessor, such as patterns for recognzng attacks and converson templates. Ths Tranng Data s responsble for generatng the ntal rule sets that needs to be used for devaton analyss. It can be trggered automatcally based on tme or the amount of pre-processed data avalable. The proposed Outler Detecton Algorthm examnes the network data and creates a descrpton of dfferences and stores n the outler vectors for further reference. If a devaton s detected t sgnals the alarm unt. A strategy for nvokng the devaton analyzer s by queryng perodcally the outler vectors for the new profles. Also the profler may sgnal when a new profle s added and the Alarm Unt s responsble for nformng the admnstrator when the devaton analyzer reports unusual behavor n the network stream. Ths can be n the form of SMS, e-mals, console alerts, log entres etc. In the data preprocessng step as shown n Fgure 1, packets are captured usng JPCAP lbrary and nformaton s extracted that ncludes IP header, TCP header, UDP header, and ICMP header from each packet. After that, the packet nformaton s parttoned and formed nto a record by aggregatng nformaton every 30 mnutes. Each record conssts of data features consdered as the key sgnature features representng the man characterstcs of network data and actvtes. IV. PROPOSED ALGORITHM A. Change Pont Outler Detecton (CPOD): To llustrate the problem, network data collected s observed wth threshold values n the college local area network at regular ntervals of tme wndow for a certan perod of tme. Most of the threshold varatons may be statstcally regular, but once a whle there may be an outler pont.e. a marked devaton from the prevous data. In general detectng such outlers s mportant because they may be caused by an anomaly wthn the network or from the external envronment. B. CP Dstrbuton Snce the CP can occur randomly and at dfferent tmes the current model assumes that the number of CP m s fxed and treated as an unknown random varable. If there are n observatons whch are denoted by o 1,o 2,..., o n, and a set of CP denoted by 0 < c 1 < c 2 < < c m < n, where the number of CP m s unknown t s assumed that the CP occur at dscrete tme, 1,..., n 1.From ths a pror dstrbuton of the CP s consdered. C. Samplng stage for CP 1. At tme n the algorthm starts 2. N data collected s sampled for tme t wthout attack 3. Wthn ths data sample f any CP s detected t s saved as a tranng data wth parameter W 4. These values are updated to the tranng database Ths algorthm has a computatonal cost of O(n). The followng are the requrements of CPOD algorthm. The statstcs should be on lne meanng an outler has to be detected as t appears. A change pont has to be detected wthn some constant number of observatons after the change happens. Specfc assumptons regardng dstrbutons are not done and hence the detecton can be adaptve to a nonstatonary tme seres and robust to a wde varety of dstrbutons. D. The CPOD Algorthm We denote a data sequence as {x : = 1, 2,... N}, s the tme varable, p denotes the number of data ponts to be observed before ntatng analyss. Cx denotes the current data pont n the tme seres beng consdered for analyss. t and s denotes the thresholds for change pont and outler detecton respectvely. Threshold value s the mean magntude of fluctuaton allowed n the data ponts wthn whch they won t be classfed. Wndow sze w, v denotes the number of data ponts to consder for computng the medan and meanng respectvely. The algorthm chooses medan over a small wndow, as t s less senstve to outlers and helps n localzng the devaton. w < v n all cases, (w/v) < 0.5 s found optmal. We mantan a vector to sgnfy the classfcaton state of each data pont. States could be {0,1,2,3} where 0 means nether outler nor change pont, 1 means outler, 2 means outler wth hgh probablty that prevous pont was the change pont, and 3 means the change pont done from prevous two observatons. If the thresholds are well tuned, CPOD can detect maxmum outlers and change ponts n a tme seres. CPOD Algorthm (Input : p,s,t,w,v) Step 1: The teraton for all data ponts s done after ntalzng =p+1 ( > p p < w < v < (N )) Step 2: The medan and mean over the wndows v, w s computed respectvely as n (1) and (2) ~ w x 1 C x~ = Mean of values n wndow v x v C = x 1 (2) (1) 50 P a g e

4 (IJACSA) Internatonal Journal of Advanced Computer Scence and Applcatons, Step 3: Score1 s the rato of absolute dfference between the current data pont from the medan to the mean amplfed by the threshold and calculated as Score 1 = ( Cx - C x~ * t) / C x and (3) Score 2 s the normalzed rato of two dstance magntudes.e. the medan from mean and the mean from the current data pont and calculated as x~ x Score 2 = ( C - C )/ ( C x - C x~ ) * 100 (4) The medan s over the short term wndow w and mean over the longer term wndow v. By takng rato, makes the score robust to fluctuatons that may happen n the mean over a long term. We heurstcally found w/v < 0.5 to be the best choce. The resoluton of detecton s dependent on the threshold. If Score1 > Score2, we classfy the pont as an outler. Score2 s used as a data-dependent cutoff to classfy Score1 as outler or not. Score1 s senstve to mean and to the devaton of current data pont from medan. Score2 s senstve to devaton of current pont from mean and to devaton of mean from medan. In wndow v, Score1 wll be greater than Score2, wth the presence of outlers or wth data ponts subsequent to a change pont. Step 4: A stronger possblty of current data pont beng an outler or CP s ndcated f Score1 s hgher than Score2. To classfy the current data pont as CP an addtonal check s made to fnd f the pont les beyond a certan band around the medan represented as LL and UL. The classfcaton state s then saved n vector V. Score 1 Score Score 2 2 ( Cx ( LL Cx LL Cx UL ) : V UL ) : V 0 1 Step 5: State nformaton n vector V s used to classfy outler and CP. If the current pont has a hgher Score1 as ndcated n V the past three states are consdered for classfcaton. Vector V s s used to express the sum state of V,V -1 and V -2. V s stores state of the current data pont wth respect to past two data ponts. If the value of V s s 3 t ndcates that outlers were detected n the past and current pont could be the change pont. We test the prevous states to make sure there was no change pont detected n the past two data ponts. If detected then the CP s nferred as an outler. Smlarly f the value of V s s 1 then t s possble that current pont s an outler as shown n (6) and (7). V = 1 : V s = (V + V 1 + V 2 ) (6) = 0 : V s = 0 V s = 3 (V s 1 = 1 (V s 1 (5) = 3 V s = 3) : V 2 s = 1 (7) = 1) : V s = V s + V s - 1 = 1 V s 2 Fnally Cx s classfed dependng on the values of V s. If the state of current pont s 0, then there s no sgnfcant devaton. If the current pont s 1 or 2 and the current data pont devates more than s% threshold t s nferred as an outler and sgnfes a hgher possblty of Cx - 1 beng a CP. If the state of current pont s 3, wth accuracy t s nferred that two ponts pror to current one s the CP. V s = 0 : No change, adapt LL, UL to C x~ (8) = (1 2) ( Cx > (Cx + s % Cx ) ) : Outler > 2 : Change pont, adapt LL, UL to change Step 6: The classfcaton of outlers and change ponts as sgnfed n the V s vector s reported. The scores and state elements of vector V, V s for past data ponts N, N-1 and N-2 are perssted. Persstence of medan and mean over the wndow szes whle classfyng current data pont enables onlne mplementaton. Table I Lst of Network Dataset Features Collected 1. appname 2. totalsourcebytes 3. totaldestnatonbytes 4. totaldestnatonpackets 5. totalsourcepackets 6. sourcepayloadasbase64 7. sourcepayloadasutf 8. destnatonpayloadasbase6 9. destnatonpayloadasutf 10. drecton 11. sourcetcpflagsdescrpton 12. destnatontcpflagsdescrpton 13. source 14. protocolname 15. sourceport 16. destnaton 17. destnatonport 18. startdatetme 19. stopdatetme RVM s currently of much nterest n the research communty as they provde a number of advantages. RVM s based on a Bayesan formulaton of a lnear model wth an approprate pror that results n a sparse data representaton. As a result, they can generalze well and provde nferences at very low computatonal cost. Many applcatons lke object detecton and classfcaton, target detecton n mages, classfcaton of mcro calcfcatons from mammograms etc are developed. RVM produces a functon whch s comprsed of a set of kernel functons also known as bass functons and a set of weghts. Ths functon represents a model for the system presented to the learnng process from a set of tranng data set. The kernels and weghts calculated by the learnng process and the model functon defned by the weghted sum of kernels are fxed. From ths set of tranng vectors the RVM selects a sparse subset of nput vectors whch are deemed to be relevant by the probablstc learnng scheme. Ths s used for buldng a functon that estmates the output of the system from the nputs. These relevant vectors are used to form the bass functons and comprse the model functon. In the classfcaton phase each of the network data selected from the feature selecton phase s classfed as normal data or attack data. Ths phase conssts of two man dataset whch are used for tranng and testng. The log fle contans four weeks of tranng data and one week of testng data. A total of 19 features are captured as lsted n Table I. Durng the frst phase tranng s performed usng RVM wth a set of network records wth known answer classes. Based on the tranng the IDS model can 51 P a g e

5 classfy the data n each record nto normal network actvty or man attack types. Then the model s tested wth new or untraned dataset where each record was captured n a real tme envronment n the college research lab. For an nput vector x, an RVM classfer models the Probablty dstrbuton of ts class labeled C ε (1, +1} usng logstc regresson as ( ) (9) ( ) where f RVM (x) the classfer functon s gven by, f RVM (x) = α K(x,x ) (10) where K(.,.) s a kernel functon, and x, = 1,2,...,N, are tranng samples. The parameters α, 1, 2,..., N, n f RVM (x) are determned usng Bayesan estmaton, ntroducng a sparse pror on α The parameters α are assumed to be statstcally ndependent obeyng a zero-mean Gaussan dstrbuton wth varance λ -1, used to force them to be hghly concentrated around zero, leadng to very few nonzero terms n f RVM (x). (IJACSA) Internatonal Journal of Advanced Computer Scence and Applcatons, V. EXPERIMENTAL RESULTS Sample statstcs of IP addresses and ther count observed n our research laboratory for a tme perod of 30 mnutes specfed as wndow w 1, w 2, w 3. Fgure 2. Plot of real tme data and detecton of change pont and outlers Table II Sample statstcs of IP addresses Source IP Tme Tme Tme Address Wndow w 1 Wndow w 2 Wndow w (a) Average Packet count n the course of a day For the real tme statstcs the data was collected for one week and the graph s as shown n Fgure 2 and 3. (b) Traffc Statstcs n the course of a month Fgure 3. Plot of real tme data collected for 2 weeks Table III Comparson between RVM and SVM models Model SVM Number of tranng data Number of vectors Testng Performance P a g e

6 (IJACSA) Internatonal Journal of Advanced Computer Scence and Applcatons, RVM Table III shows the comparson between the SVM and RVM models. The value of testng performance from RVM model s effectvely same as that of SVM wth lesser support vectors. The performance of the RVM s also better than the SVM. VI. CONCLUSION In ths research work a soluton for classfyng outlers and change ponts from real tme data s proposed whch s addressed n two parts: scorng and classfcaton. Scores are computed that reflect outlers and ncrementally dscover to keep the state of outlers n data seres. The algorthm s characterzed n ts property to address outlers and change ponts at the same tme. Ths enables to deal wth frequent and fast changes n the source. The current mplementaton and usage ndcates the success of the algorthm. Ths gves a unfyng vew of outler detecton and change pont detecton n real tme network data. Usage of RVM shows a compettve accuracy mantanng ts sparseness ablty. Expermental results show that the RVM model acheves essentally the same performance wth a much sparser model as a prevously developed SVM model. The much reduced computatonal complexty n RVM makes t more feasble for real tme processng whle desgnng IDS. The proposed method s compettve wth respect to processng tme and allows the use of selected tranng data set. The result shows an mprovement n RVM classfcaton performance. In ths work, the desgn and successful mplementaton of a system wth outler detecton was done. REFERENCES [1] Oln Hyde, Machne Learnng For Cyber Securty at Network Speed & Scale, 1 st Publc Edton: October 11, 2011 [2] Iftkhar Ahmad, Azween Abdullah and Abdullah Alghamd, Towards the Selecton of Best Neural Network System for Intruson Detecton, Internatonal Journal of the Physcal Scences Vol. 5(12), October, 2010, pp [3] Fabo Pacfc, Change Detecton Algorthms: State of the Art, v1.2, Earth Observaton Laboratory, Tor Vergata Unversty, Rome, Italy, Feb 28, 2007 [4] G. Mohammed Nazer, A. Arul Lawrence Selvakumar, Current Intruson Detecton Technques n Informaton, European Journal of Scentfc Research, EuroJournals Publshng, Inc. 2011, pp [5] Lao Y, Vemur VR. Use of K-nearest Neghbor Classfer for Intruson Detecton. Computers & Securty 2002;21: [6] M. Al-Subae and M. Zulkernne. Effcacy of Hdden Markov Models Over Neural Networks n Anomaly Intruson Detecton. In 30th Annual Internatonal Computer Software and Applcatons Conference (COMPSAC 06), pages , [7] N. Ben Amor, S. Benferhat and Z. Eloued. Nave Bayes vs Decson Trees n Intruson Detecton Systems. In SAC 04: Proceedngs of the 2004 ACM symposum on Appled computng, pages , New York, NY, USA, ACM. ISBN [8] Sandhya Peddabachgar,Ajth Abraham, Crna Grosanc,Johnson Thomas, Oklahoma State Unversty, Modelng Intruson Detecton System Usng Hybrd Intellgent Systems, Journal of Network and Computer Applcatons, Elsever Ltd, 2005 [9] Zhqang ZHANG, Janzhong CUI, Network Intruson Detecton Based on Robust Wavelet RVM Algorthm, Journal of Informaton & Computatonal Scence, 2011, pp [10] Rung-Chng Chen, Ka-Fan Cheng, Cha-Fen Hseh, Usng Rough Set and Support Vector Machne for Network Intruson Detect, Internatonal Journal of Network Securty & Its Applcatons (IJNSA), Vol 1, No 1, Aprl 2009 [11] M. Tppng, "Sparse Bayesan Learnng and the Relevance Vector Machne", Journal of Machne Learnng Research, 2001, pp [12] D He, Shangha Jao Tong Unversty, Improvng the Computer Network Intruson Detecton Performance Usng the Relevance Vector Machne wth Chebyshev Chaotc Map, IEEE, 2011 [13] Reza Sadoddn, Al A. Ghorban, An Incremental Frequent Structure Mnng Framework for Real-Tme Alert Correlaton, Computers & Securty, 2009, pp [14] Shaohua Teng, Hongle Du, Naq Wu, We Zhang, Jangy Su, A Cooperatve Network Intruson Detecton Based on Fuzzy SVMs, Journal of Networks, Vol. 5, No. 4, Aprl 2010 [15] Phurvt Sangkatsanee, Naruemon Wattanapongsakorn, Chalermpol Charnsrpnyo, Practcal Real-Tme Intruson Detecton Usng Machne Learnng Approaches, Computer Communcatons, 2011, pp [16] L Ru, Computer Network Attack Evaluaton Based on Incremental Relevance Vector Machne Algorthm, Journal of Convergence Informaton Technology, JCIT, Volume7, Number1, January 2012 [17] Javer M. Moguerza and Alberto Munoz, Support Vector Machnes wth Applcatons, Statstcal Scence, 2006, Vol. 21, No. 3, pp [18] Chenfeng Vncent Zhou, Chrstopher Lecke, Shanka Karunasekera, A Survey of Coordnated Attacks and Collaboratve Intruson Detecton, Computers & Securty, 2010, [19] Georgos P. Spathoulas, Sokrats K. Katskas Reducng False Postves n Intruson Detecton Systems, Computers & Securty, 2010, pp [20] Anna Koufakou, Mchael Georgopoulos, A Fast Outler Detecton Strategy for Dstrbuted Hgh-Dmensonal Data Sets wth Mxed Attrbutes, Data Mnng Knowledge Dscovery, 2010, pp [21] Wu, S., & Yen, E., Data mnng-based ntruson detectors, Expert Systems wth Applcatons, 2009, pp P a g e