A Multi-Layer Hybrid Intrusion Detection Method Based on Nb And SVM

Intrusion detection aims to identify malicious behaviors in computers and networks, but common firewalls are difficult to detect unknown intrusion behaviors. Intrusion detection system is mainly developed based on machine learning. Due to the imbalance of intrusion detection related data set, the detection of low-frequency attacks and high-frequency attacks can't be considered at the same time. In order to solve this problem, a multi-layer hybrid intrusion detection model (MLH-IDM) is proposed. The redundancy of the features can be reduced by filtering the features of data set with Pearson correlation coefficient, and the data set can be balanced with the random down sampling technique. The whole detection adopts the method of layered detection. The first layer is to filter the Probe separately by the Naive Bayes (NB) classifier; the second layer uses Naive Bayes classifier to filter DoS and Probe, so as to prevent the first layer from filtering impure; in the third layer, Support Vector Machine (SVM) is used to detect low-frequency attacks U2R and R2L. The simulation experiment based on NSL-KDD data set shows that compared with the benchmark paper, MLH-IDM improves F1 score and recall rate by 1.05% and 3.22%; The detection rates of R2L, Probe and DoS attacks are increased by 2.02%, 9.13% and 1.77%.