An Improved Naive Bayes Algorithm And Its Application In Intrusion Detection

With the rapid development of information, the number of the Internet user is rapidly growing. The users is faced up with more and more network security incidents with more and more serious impact. Traditional network security measures is no longer able to meet the network security needs completely. Intrusion detection technology is a security technology to make up for the shortcomings of traditional network security technology proactively, which can detect network intrusions and take appropriate actions before the system severely damaged. Data mining is a data analysis technology to discover useful knowledge from massive data, for later use. Bayesian classifier is a classification of data mining algorithms, it is based on Bayes' theorem. Bayesian classifier uses prior probability to predict posterior probability. Intrusion detection based on Naive Bayes can detect novel intrusions according to the past intrusion records, which is simple, easy to implement and has a better classification ability. But the assumption that all attributes are independent to each other deduces the classification accuracy, increases the false alarm rate.Based on the above study background, an improved Naive Bayes algorithm is proposed, which uses a fuzzy value to reduce the independence so that the detection rate rises and false alarm rate decreases. Besides, the Bayesian classification based on fuzzy value can be improved by using classification tree, which believes the most different category should be split first. Assuming there are K categories, then train K-1 the improved Bayesian classifications. Each Bayesian classification is 1-vs-rest. Then this paper utilizes Artificial Fish Swarm Algorithm(AFSA) to find optimal feature subset corresponding to each category and selects appropriate fuzzy value. By using this method,we can increase the detection rate, accuracy and decrease false alarm rate as far as we can.Through simulation results we find that: the proposed method can improve the detection rate and reduce the false alarm rate effectively.