| With the development of Internet during the recent years, information security has become more and more important. Intrusion detection is a key component of the whole information security system. But the current detection methods have high efficiency for some certain and known intrusion, while high detection false alarm rate for other intrusions, how to detect and prevent intrusions efficiently with low false alarm rate has been a hot topic and a key problem in Internet.In order to improve the performance of intrusion detection system, selective ensemble is introduced to the implementation of intrusion detection system in this paper. Based on the detailed analysis of intrusion data, a common data model of intrusion character, which normalizes the original data of current event into the data structure of common models to achieve the character vector of current event, is defined in the paper. Then the category of the current vector, which is determined by the type attribute of character vector, is used to select the according analysis engine for intrusion detection. With the ensemble function of selective ensemble, the result of each kind of event is achieved by selective ensembling the results of different detection methods. In the experiment section, each detection algorithm is tested with the DARPA data, and with ROC curves, it is verified that the new selective ensemble method can achieve a better performance than both single intrusion detection method and ensemble all of methods, and it also can obtain low detection error rate for the intrusion detection system. The main contribution of this paper is as following.Firstly, a common data model of intrusion character is defined as E_i=BASE(?) CLASS; (1≤i≤n).In the model, the combination of a base character and n class characters is used to represent a kind of event, with the base character representing the basic part of the event and the class characters representing the individual event character. In the model, two-dimensional storage method can be used to save the common data model of intrusion characters.Secondly, a new selective ensemble method and an ensemble function are introduced in the paper. A recursive method to get the optimal ensemble function, in which each detection algorithm is regarded as the same component and with the same weight at the beginning, and recursively reaches to its optimal weight by adjusting data set, is introduced to efficiently improve the intrusion detection performance. |
