Intrusion Detection Method Using Protocol Classification and Rough Set Based Support Vector Machine

Transcription

1 Computer ad formatio Sciece trusio Detectio Method Usig Protocol Classificatio ad Rough Set Based Support Vector Machie Xuyi Re College of Computer Sciece, Najig Uiversity of Post & Telecommuicatios Najig 003, Chia Ruchua Wag College of Computer Sciece, Najig Uiversity of Post & Telecommuicatios Najig 003, Chia State Key Lab. for Novel Software Techology, Najig Uiversity, Najig 0093, Chia Heju Zhou College of Computer Sciece, Najig Uiversity of Post & Telecommuicatios Najig 003, Chia Abstract order to improve the efficiecy of support vector itrusio detectio, we first do protocol Classificatio for the itrusio data, the refie its characteristic by rough set reductio. By usig these procedures, we propose a itrusio detectio method usig protocol classificatio ad rough set based support vector machie. The method is divided ito traiig ad testig processes. the process of traiig, we first do protocol classificatio for the traiig data, ad the do rough set refiemet. The refied characteristics are stored as the pre-defied process, ad fially the usage of support vector machie for data reductio traiig, the traiig model will be stored i accordace with the agreemet. the testig process, the data is classified accordig to protocol classificatio ad the start the characteristics reductio procedure accordig to protocol classificatio. Fially, make a decisio usig the Support Vector Machies that correspodig to the agreemet. The experimetal results based o KDDCUP'99 data show that the method is the method is faster ad the detectio accuracy is comparable compared with the SVM without usig protocol classificatio ad usig all characteristic. Keywords: trusio detectio, Support Vector Machie, Rough set. troductio Support Vector Machie, refer to Vapik, 995, Burges, 996, P.-67, is based o structured risk miimizatio ad statistic theory. t overcomes the shortcomig such as difficult to hadle of small samples, high dimesio, over-matchig, local miimizatio problems etc, that exists i the covetioal methods like atural etwork. Therefore, it is a ew high performace learig method, ad it has bee widely applied i itrusio detectio face reorgaizatio, voice processig ad so o. trusio detectio is essetially a classificatio problem. t ca be viewed as a classificatio process for test samples of traiig models. However, the costructio of itrusio detectio model eeds to do learig for thousads of samples; there are tes of characteristics for every sample. Moreover, samples have the property of differet structure. f we put the etire characteristic ito itrusio detectio, SVM will have to solve complex a quadratic programmig problem. Therefore, the method is iefficiet. Actually, certai depedet relatioship exists i the high dimesio characteristics, therefore, how to fid this depedece, ad the compress the data so as to reduce the dimesio, are sigificat for shorte SVM traiig time, detectio time, ad choosig the optimal parameter (Mukkamala, Jaoski &.Sug, 00, P , Sug, 405-4, Li &.Cuigham, P.90-98). (Frohlich, Chapelle & B.Scholkopf, 003, P.4-48), the geetic algorithm is 00

2 Computer ad formatio Sciece November, 009 adopted to optimize the model ad characteristic chose. (Roberto, Guofei & Weke, CDM'06), -grams is chose to choose the host computer character ad costruct a combied SVM detector. (Sug, P.405-4), the weighted SVM W is adopted to order ad choose the characteristic, ad by deletig the low iflueced characteristics so as to fid the most efficiet two kids of methods. These kids of methods have made cosiderable progress; however, these methods are always distillig the characteristic from all the data. Actually, the itrusio detectio usually uses the leak of the protocol, ad for every kid of protocol, the itrusio data has differet characteristic. For differet protocols, if differet characteristic is used, the method will more powerful, ad hece it will be helpful for improvig the learig efficiecy of the model. Rough sets (Pawlak, 98, P ) is a frequetly used method for distillig the characteristics, it is efficiet i decreasig the dimesio of data. this paper, we propose to combie the protocol classificatio ad rough sets methods, ad so as to produce a itrusio detectio method that is based o protocol classificatio ad rough set SVM. By classifyig the data based o data protocol, ad reductio, we ca give the traiig ad detectio model. Usig the KDDCUP 99 itrusio data, we verify the method.. Classify Support Vector Machie (Vapik, 995, Burges, 998, P.-67) Suppose {( x, y ),( x, y ),,( x, y )} L is a group of sample data, with x R d, y i i {, + }. We wat to fid the optimal partitio plae y = W X + b, which is equivalet to solve the covex quadratic Burges programmig problem: N T mi imize w w + C ξi wb,, ξi i= T st y ( w X + b) + ξ 0, ξ 0, i N i i i i Where w is the ormal vector of hyperplae, b is the deviatio, while C a puish fuctio parameter i the case of icomplete itegral, ad ξ is a relaxatio parameter i the case of relaxig i the costrait coditios. By itroducig the Lagrage multiplier: T Lp = w aiyi( w Xi + b) + ai aξ i i The do partial differetial for Lp : i= i= i () () Lp = 0 w= aixiyi w i= Lp = 0 ay i i = 0 b i= Lp = 0 0 ai c ξ i order to obtai ai, we covert the origial problem i to a dual problem, ad itroduce kerel fuctio K (,) : (3) max imize Q = a a a y y K( X, X ) D i i j i j i j i i, j i i i = i= st 0 a C, a y 0, i N (4) By solvig (4) we ca obtai ai, the submit it ito (3) we have: w= a X Y. As the quadratic programmig i i i i = problem satisfy the KKT coditio, so we have b= y y a K( X, X ), with a is a coefficiet larger tha 0. As j i i i j i i = oly whe a > 0, it has effect o the value of QD. Therefore, we call the support vector correspodig to a > 0 as the i i support vector of Xi. The we ca get the decisio fuctio f ( X) = sg( * y a K( X, X) b) i i i + i = 0

3 Computer ad formatio Sciece 3. Rough Sets Rough sets are proposed by Z.Pawlak i 98, it is a data miig method which ca be used to study the icompleteess of data, ad ucertaity of kowledge. The basic idea of data reductio by usig rough set theory ca be outlied as follows: it fid the decisio regulatio by the depedece relatioship betwee the sample attribute ad the decisio attribute; the judge the importace by the degree of ifluece of attribute to the decisio. By these procedures, the uimportat attribute ca be removed, so as to achieve the classificatio ability of reduce the data characteristic ad preserve the data ature. Defiitio. formatio system is a four umber set =<S,A,V,F>, with U is the oempty sample set, ad A is the attribute set, ad V is the attribute value regio, ad F is the map, which ca give a value from V for every sample attribute A i S. For the traiig sample, there is some classificatio marks, such as the 4 dimesioal itrusio sample of KDDCUP 99 is ormal, abormal ad so o. These attributes are called decisio attributes. By itroducig the decisio attribute, we ca obtai the decisio graph by the iformatio system. Defiitio. The decisio graph of iformatio system is a four umber set T=<S,A&{d}, V, F>, with A be the sample attribute, ad its value a is called as coditio attribute, ad d is the decisio attribute. Defiitio 3. discrimiate relatioship ca be described as follows, i the decisio graph DT, with B A, for ay sample i S, we have F( a) = F( a ' ), the such a relatioship is called the iseparable relatioship betwee A ad its subset B (B-idiscrimiate relatio), deoted by ND ( B), where ND ( B) refers to the idiscrimiate relatioship of attribute, i.e. the sample ca ot be discerible from attribute B. The decisio idiscrimiate relatioship ca be costructed based o the cocept. Defiitio 4. The idiscrimiate relatioship of decisio is refer to the followig fact, i ND ( B), we have F( x, d) = F( x ', d), deoted by ND ( B, d). Defiitio 5. The decisio reductio refers to that i DT; we seek the smallest attribute set such that ND ( B, d) = ND ( A, d) holds. l Though the decisio reductio is a NP hard problem, there exist may fast reductio algorithms; this topic is beyod the discussio of this paper. Decisio graph ca be established by the decisio graph discrimiate matrix. Defiitio 6. Suppose M is the decisio graph discrimiate matrix costructed based o DT, the elemet Mij o the (i, j) positio is defied as follows, M { aa A f( xi ) f( xj )} f( xi, d) f( xj, d) = { ij 0 f ( x i, d ) = f ( x j, d ) By classifyig the data protocol, ad costruct a decisio graph for every group of data, the reduce the decisio graph usig the reductio algorithms, the we ca obtai the differet data set reduced from differet data protocol. 4. The SVM itrusio detectio method usig protocol classificatio ad rough Set the former ivestigatio of rough set data reductio, the protocol is idiscrimiate ad the reductio is for all the data. There are two shortcomigs i these approaches: firstly, all the data is strogly differet structured, study the data usig SVM, we eed to itroduce a ew computatio method for distace. O the other side, itrusio usually takes the leak of the differet structured data. The idiscrimiate protocol is just a broad detectio method, it does ot cosider the differet characteristic i differet data, ad hece these methods are ot aimed. We propose the SVM itrusio detectio method usig protocol classificatio ad rough sets, it is able to remove the shortcomigs i the origial methods, ad is able to improve the detectio time ad the accuracy. Classifyig the protocol, usig the rough set to reduce the data, the do traiig to the reduced data, i.e. the correspodig SVM iput. The obtaied traiig model is the SVM detector correspodig to differet protocol. The SVM itrusio detectio method usig protocol classificatio ad rough sets ca be described as the followig Fig. Fig, the real lie illustrates the traiig process, the traiig data is classified accordig to protocol. Three differet kids of itrusio data is divided, deoted by TCP, UDP, ad CMP. The carryig out the rough sets study for these three kids of itrusio data, the studyig procedure is deoted by T, U, ad. The reduced characteristic after study is used as the SVM study iput; o the other had, the reduced regularizatio is stored as the pre-defiitio process, deoted by reductio T, reductio U ad reductio. Three SVM study apparatus will become three detector models after study; they are stored as three detectors T, U ad. Figure, the dash lie deotes the detectio process of the test data. The test data first classified by the protocol, the the reductio procedures are started based o differet protocol data, the reduced data is iputted ito correspodig detector, ad the test results come from the detector. The 0

4 Computer ad formatio Sciece November, 009 SVM itrusio detectio method usig protocol classificatio ad rough sets ca be described as the followig algorithm: Step : put the traiig data, start protocol classificatio, the data is divided ito TCP, UDP, AND, CMP accordig to differet data protocol; ad they are stored i database. Step : Start the rough sets study machie, reduce three kids of data separably,the obtai their ow reduced characteristic set T, U ad. The costruct a SQL setece based o the characteristic set, which is stored as the pre-defiitio process. Fially, the reduced traiig data is iputted ito the correspodig SVM study machie. Step 3: Start the SVM study machie T, U ad, the obtai their ow decisio fuctio by study. f ( X) = sg( y a K( X, X) + b), stored as detector U, T, ad. i i i i = Step 4: For the iput data X to be detect, first do protocol classificatio, the start the pre-defied rough sets reductio process accordig to classificatio. Step 4: put the reduced data ito the correspodig SVM detector, the output the detectio results through the SVM detector, ormal is deoted by +, ad abormal is deoted by Experimet 5. The tested data KDDCUP 99 is obtaied i the real et work. t ca be used to simulate the 5 classes icludig 3 differet kids of data arisig from attack, these data ca be used as experimetal data i data miig. The 0% subset of the data has 4940 records, ad each record has 4 characteristics, which icorporate the cotiuous, discrete ad text data. We ca put a ote at the ed of each record to show whether the data is ormal. Therefore, such kid of data set is a classical multi-protocol multi-attack differet structured data set. By classifyig the protocol for the ormal ad attack situatios, the results are illustrated i Figure as follows Statistical results show that TCP protocol records are 90064, ad CMP protocol records are 8360, ad UDP protocol records are the TCP protocol classificatio, there are all differet kids of attack, ad DoS attack most frequetly. the UDP ad CMP protocol, the RL ad UL attack almost ever appear. For the UDP protocol, the abormal data icludes DoS ad Probe. For the CMP protocol the DoS attack has 80 thousads records. The abormal data is maily DoS data. After protocol classificatio, we begi to do test from selected traiig data ad test data, the test results are outlied as follows, (). TCP test data: Choosig records from the TCP data set, where the ormal data is 80 items; ad abormal data is 798 items (DOS has 6560 items, Prob has 4 items, RL has 88 items, UL has 8 items). (). UDP test data: Choosig 073 records from the UDP data set, where the ormal data has 9586 items, ad abormal data has 587 items (DoS has 489 items, Prob has 98 items). (3). CMP test data: Choosig 8353 records from the CMP data set, where the ormal data has 8 items, ad abormal data has 85 items (DoS has 805 items, ad Prob has 0 items). Takig 70% data radomly from the test data set for traiig; the leavig other 30% for test. 5. The reductio of the test data Reducig the data by meas of Rosetta tool Komorowski, 997, P , ad form differet reductio set from the 4 reduced characteristic. The characteristic set reduced from TCP, UDP ad CMP are outlied i the followig Figure 3, Figure 4 ad Figure 5. Choosig two groups of characteristic set, for example, take the first ad the eighth from TCP, ad take the sixth ad the 30th from UDP, ad take the sixth ad the eighth from CMP. By reducig the characteristic for the correspodig traiig data ad test data, we ca obtai the traiig data ad the test data after characteristic reductio. Compare with the characteristic with the oes give i Sug P.405-4, we ca see our approach has less characteristic ad easier to deal with, ad fially the test result shows that the our method ca preserve high accuracy ad much faster. 5.3 Data traiig ad detectio the test, we choose RBF fuctio f( x, x ) = exp( ( x x )/ σ ) as the SVM kerel, ad adopt 5-Fold Cross i j i j Validatio, embedded i the LibSVM software by Chihje. The test is i three steps, firstly, we use grid search (grid.py commad) to compute the optimal puish parameter C ad σ, the obtai the traiig model by trai the traiig data 03

5 Computer ad formatio Sciece usig the optimal parameter. ad fially test usig the traied data. Take the example usig 000 TCP traiig data ad 9000 test data, the parameter search is outlied i Figure 6. The optimal value isc = 5, σ = By usig these two parameters to trai the 000 TCP data, we obtai trai.txt.model. The we use this model to do test for these data. Fially, we obtai the traiig time, the detectio time, ad the accuracy. For compariso reasos, the itrusio data ad detectio is divided ito three situatios. The first is to do test o the classified data by the complete characteristic. The secod is to do test o the classified data by the reduced characteristic. The third is to do test o the uclassified data. The fial test results are outlied i Figure, Figure ad Figure 3. Comparig Figure ad Figure 3, we ca discover that the traiig time ad the detectio time is shorte by usig protocol classificatio, moreover, the detectio accuracy is ot damaged. Comparig Figure ad Figure, we ca see that usig characteristic reductio ad ot usig characteristic reductio has similar accuracy, however, the detectio time ad traiig time is saved obviously by usig the characteristic reductio. Therefore, our coclusio is as follows, protocol classificatio alog with characteristic reductio eed less time, while usig the complete characteristic eed much more time, further more time is eeded if protocol classificatio ad characteristic reductio are all ot carried out. 6. Cocludig remarks this paper, we propose to use iteret protocol classifyig the itrusio data, ad use rough sets to reduce uclassified data, ad the do traiig for the reduced data, ad fially produce a traiig model. the test procedure, we first do protocol classificatio for the data, the do test for the model after traiig. We do some tests o the KDDCUP 09 data uder three cases, the test results show that the ew method produce more accuracy results, ad eed less traiig ad test time. By theoretical aalysis, the reaso is as follows: as we have adopted protocol classificatio, which elimiate the difficulty caused by the ustructured protocol character, this reduces the time eeded i dealig with data. O the other had, as itrusio is due to the hole of protocol, so it is more targeted ad the accuracy is ot damaged because of the characteristic decrease. The future work will be implemet a itrusio detectio system based o the algorithm proposed i this paper. This will ot oly cosider the protocol classificatio, but also eed to cosider that real iteret itrusio actually a usupervised character classificatio. Furthermore, it also eeds multi-class classificatio techique research. Refereces [DB/OL]. Burges C. (998). A tutorial o support vector machies for patter recogitio, Data Miig ad Kowledge Discover. No..P Chihje L. LBSVM: a library for SVMs (Versio.6) Frohlich H., Chapelle O., & Scholkopf B. (003). Feature selectio for support vector machies by meas of geetic algorithm. : Proceedigs of 5th EEE teratioal Coferece o Tools with Artificial telligece. No.3-5. P Komorowski J.O., & ROSETTA. (997). A rough set toolkit for aalysis of data. Fifth teratioal Workshop o Rough Sets ad Soft Computig. Tokyo,Japa. P Li Y., &.Cuigham A. A New Approach to Fuzzy-Neural System Modelig. EEE Trasactios o Fuzzy Systems, No.3. P Mukkamala S., Jaoski G., & Sug H.(003). trusio Detectio Usig Neural Networks ad Support Vector Machies. Proceedigs of EEE teratioal Joit Coferece o Neural Networks, P Pawlak Z. (98). Rough sets. teratioal Joural of formatio ad Computer Scieces. No., P Roberto P., Guofei, G., & Weke L. (006). Usig a Esemble of Oe-Class SVM Classifiers to Harde Payload-based Aomaly Detectio Systems. Proceedigs of the Sixth teratioal Coferece o Data Miig (CDM'06). Sug A. (998). Rakig mportace of put Parameters of Neural Networks. Expert Systems with Applicatios. No. 5. P Vapik V. (995). The ature of statistical learig theory. New York: Spriger-Verlag. 04

6 Computer ad formatio Sciece November, 009 Table. Experimetal result with protocol differece but without reductio protocal best c,σ Traiig time Test time Test correct rate TCP c=5, σ = s.6s % UDP c=8, σ = s.3s % CMP c=8.00, σ = s.4s % Table. Experimetal results with protocol differece ad reductio protocal Feature set Best c, σ Traiig time Test time Test correct rate TCP c=048, σ = % 8 c=3768, σ = % UDP 6 c=048, σ = % 30 c=048, σ = % CMP 6 c=5, σ = % 8 c=3, σ = % Table 3. Experimetal results without protocol differece ad reductio Data set best c, σ Traiig time Test time Test correct rate c=5, σ = % 073 c=8, σ = % 8353 c=64, σ = % 05

7 Computer ad formatio Sciece Figure. The SVM itrusio detectio method usig protocol classificatio ad rough sets KDDCUP 0 UL RL 0 Normal&Attack Prob DoS CMP UDP TCP Normal Data Record Figure. KDDCUP 99 itrusio data protocol classificatio. NO Feature set after Reductio support legth 3,4,6,4,3,4,7,8,3,3,33,36, ,4,6,8,3,4, 7,8,3,3,33,36, ,4,6,4,3,4, 7,8,3,3,33,36, ,4,6,3,4, 7,8,3,3,33,35,36, ,4,6,3,4, 7,8,3,3,33,35,36, ,4,6,8,3, 4,7,8,3,3,33,36, ,4,6,0,3, 4,7,8,3,33,35,36,37, ,4,6,3, 4,7,8,3,3,34,35,36,37, ,4,6,0,3, 4,7,8,3,33,35,36,37, ,4,6,0,,8,3, 4,7,8,3,3,34,35,36,37, ,4,6,0,,4,3, 4,7,8,3,3,34,35,36,37, Figure 3. TCP reduced characteristic. 06

8 Computer ad formatio Sciece November, 009 NO Feature set after Reductio support legth 3,5 00 5,4, ,6, ,3, ,34, ,33, ,3, ,6, ,8, ,3, ,8, ,3, ,30, ,3, ,34, ,33, ,9, ,8,9, ,8,3, ,5,3, ,6,30, ,33,35, ,3,34, ,6,9, ,8,30, ,8,30, ,3,3, ,4,30, ,9,3, ,6,3, ,30,3, ,33,35, ,30,3, ,6,9, ,9,3, ,4,33, ,4,9, Figure 4. UDP reduced characteristic. 07

9 Computer ad formatio Sciece NO Feature set after Reductio support legth 5,3 00 5, ,3,3, ,3,3, ,4,3, ,4,3, ,4,3, ,4,33,36, ,4,33,34, Figure 5. CMP reduced characteristic. Figure 6. Parameter search of TCP traiig data 08