Incremental k-NN SVM method in intrusion detection

The intrusion or attack in the computer network is one of the most important issues in Cloud environment. Due to enormous network traffic, dynamic and incremental learning is important to intrusion detection system (IDS) in Cloud. In existing incremental algorithms, k Nearest Neighbors (k-NN) has the advantage of dealing with the huge and incremental multi-class nature of data. However, k-NN algorithm has poor performance in classification. Support Vector Machine (SVM) is an extraordinary classification method widely used in intrusion detection field, while its training time increases sharply with expansion of training data. Therefore, we proposed Incremental k-NN SVM method using combination of k-NN and SVM, bringing advantages of the both methods. In this approach an R*-tree provides efficient expansion of training data and query for k-NN. Experiments on open dataset KDDCUP 99 indicates that Incremental k-NN SVM intrusion detection method has the ability to learn and update with new data in acceptable time, and its predicting time does not increase rapidly along the incremental learning process.