Anomaly based intrusion detection through temporal classification

Abstract

Many machine learning techniques have been used to classify anomaly- based network intrusion data, encompassing from single classifier to hybrid or ensemble classifiers. A nonlinear temporal data classification is proposed in this work, namely Temporal-J48, where the historical connection records are used to classify the attack or predict the unseen attack. With its treebased architecture, the implementation is relatively simple. The classification information is readable through the generated temporal rules. The proposed classifier is tested on 1999 KDD Cup Intrusion Detection dataset from UCI Machine Learning Repository. Promising results are reported for denial-ofservice (DOS) and probing attack types.