A New Method of Transductive SVM-Based Network Intrusion Detection

Transcription

1 A New Method of Transductive SVM-Based Network Intrusion Detection Manfu Yan and Zhifang Liu 2 Departent of Matheatics, Tangshan Teacher s Coege, Tangshan Hebei, China 3005@tstc.edu.cn 2 Network Technoogy Center, Tangshan Teacher s Coege, Tangshan Hebei, China zf@tstc.edu.cn Abstract. Based on the existing Transductive SVM and via introducing sooth function P( Δ, λ) to construct sooth cored unconstrained optiization probe, this artice wi buid the optiization ode accessibe to degenerate soutions to generate an iproved transductive SVM, introduce siuated anneaing to degenerate the optiization probe, and appy such a Support Vector Cassifier to generate a new ethod of network intrusion detection. Keywords: optiization; unconstrained probe; transductive SVM; network intrusion detection; siuated anneaing. Introduction Network intrusion detection is a safe echanis with dynaic onitoring, prevention or resistance against network intrusion []. The network-intrusion detection syste can be used to discover and identify the behavior and attept of intrusion in the syste via onitoring and anayzing the network fow and syste audit records to give out an aar of intrusion in order to faciitate the adinister to take effective easures to end the oophoes of the syste and fi up the syste [2]. Network intrusion detection is used to separate user behavior s nora data of fro its abnora data, which essentiay can be regarded as the cassification. The data to describe the behaviors of users is of uti-index as usua. Therefore, it can be expressed with an n-diensiona vector. In this way, the network-intrusion detection probe can be suarized as data group for nora or abnora behavior of users, i.e. two kinds of cassification probes of n-diensiona vector, which can hep create the detection ethods and syste via the support vector cassifier. But studies and practices indicate that as to the network-intrusion detection probe, the ethods and syste buit by the use of ordinary SVM (e.g. C-SVM) are not desirabe in the precision of detection. Thus, we try to appy the transductive support vector cassifier to create the detection ethods and introduce the siuated anneaing ethod to degenerate the optiized ode. 2 The Iproveent of Transductive Support Vector Machine Generay, for Support Vector Machine, it is set up by given trainingset T = {( x, y), L,( x, y) } () D. Li, Y. Liu, and Y. Chen (Eds.): CCTA 200, Part I, IFIP AICT 344, pp , 20. IFIP Internationa Federation for Inforation Processing 20

2 88 M. Yan and Z. Liu Here, x n i X = R, yi Y = {, }, i =,2, L,. We noray ca the Inductive Support Vector Machine [3]. Vapnik has discussed a kind of sorting agorith for Transductive Support Vector Machine, it is different fro Inductive Support Vector Machine. It provides a utua independent set, which foows oint distribution, besides the given trainingset T. { } S = x,,, x (2) n Here x X = R. For TSVM, we want to find a optiized function f( x, w 0) fro a particuar function set F = f ( x, w), so that the risk { } ( ) ( ( i, i, )) R w = L y f x w (3) i = is iniized. Here w is a genera paraeter of the function, L( y, f ( x, w )) represents the oss due to estiation of y by f ( x, w ), that is to say, here we interested in the function vaue of f( x, w0 ) on given fixed points x, not a the function vaues within i the fied of definition. 2. Unconstraint Probe Initiay, the optiization of TSVM is [4] in w C ξ w H, b R, y R, ξξ, i C 2 2 ξ i= = s.t. yi( ( w xi) b) ξi, i,,, (4) = (5) (( ) ) y w x b ξ, =,,, (6) ξi 0, i =,,, (7) ξ 0, =,,, (8) We woud ike to sipify initia probe (4)ü(8) in this section, it is reduced to unconstraint probe. Theore. Consider the soution for (4)ü8), it ust satisfy (( ) ) y w x b 0 (9) for a x Prove: Suppose the soution for the probe is ( w, b, ξ, ξ, y,, y ) if for soe x, ( w x ) b 0, then y = Since when y =, y (( ) ) (( w x b 0, ξ y w x) b), as iniized obective function, it ust satisfy ξ = 0 or 0 ξ y( ( w x) b) = <

3 A New Method of Transductive SVM-Based Network Intrusion Detection 89 y =, (( ) ) When y w x b 0, ξ, which is arge than then obective function vaue when y =. Siiary, for soe x, ( w x ) 0 b, then y = Naey, for a x, y( ( w x) b) 0, Based upon the theore above, we can change the constraint (6) and (8) of probe (4) (8) into ξ ( ( w x ) b ), =,2, L =, However, for variabe ξ i, i=, L,, we got ξ ( yi (( w xi ) b) ), i =,2, L, () = (0) Here, function () is singe variabe function, Δ, Δ 0; ( Δ ) = 0, Δ < 0 Base on this, we coud convert probe (4) ü(8) into unconstraint optiization. (2) in w C ( y (( w x ) b)) C ( ( w x ) b) wb, 2 2 i i i= = (3) 2.2 Sooth Unconstraint Probe Since unconstraint probe(3) is not sooth it is not abe to be soved by reguar optiization ethod. As a resut, we think about odifying the second and third part of obective function for probe (3), so that it becoes sooth, in order to construct a sooth unconstraint probe that is siiar to unsooth and unconstraint probe (3). Because of that, we introduce an approxiate function for unsooth function ( Δ) λδ P ( Δ, λ) = Δ n( e ), (4) λ Here, paraeter λ >0, obviousy the function above is sooth; we coud prove it as we. When λ, function P ( Δ, λ) converges at ( Δ) such that the second part of unconstraint optiization (3) is transfored into C P( yi(( w xi) b), λ). (5) i= and the third part is transfored to = C P( ( w x ) b, λ) (6)

4 90 M. Yan and Z. Liu The unsooth ter Δ is sti inside (6), so we decide to use foowing function to approxiate Δ soothy. 2μΔ P ( Δ, μ) = Δ n( e ) (7) μ We coud deduce soe the foowing theore by aking use of the properties of P ( Δ, λ ) : Now, unconstraint probe (3) approxiates optiization probe in w C P( y(( wx ) b), ) C P( P(( wx ) b, μ), λ). wb, 2 2 i i λ i= = (8) When λμis, arge enough, the soution of sooth unconstraint probe (8) wi ost approxiate unsooth unconstraint probe (3). 2.3 Sooth Unconstraint Probe with Kerne If we take account of inear partition of input space, we coud introduce a apping fro input space X to Hibert space H and kerne function X H Φ : (9) x X =Φ ( x) K( x, x ) = ( Φ( x) Φ ( x )), (20) Appy odue w on obective function of probe (4)---(8), we got optiization probe in wbξξ,,, ξi ξ i= = (2) w C C s.t. y (( w x ) b) ξ, i=, L,, (22) i i i y (( w x ) b) ξ, =, L,, (23) ξi 0, ξ 0, i=, L,, =, L,. (24) We know that if ββis, the soution of dua probe for probe(4)ü(8), then the soution of initia probe(2)ü(24) to W coud approxiatey represented as iβi i β αi αi i α α i= = i= = (25) W= y X y X = ( ) Φ ( x) ( ) Φ( x ). We coud ater probe (2)ü(24) to foowing probe, by aking use of above expression

5 A New Method of Transductive SVM-Based Network Intrusion Detection 9 in ( α ) ( ) ααα,,, α, b, ξξ,, i αi α α C ξi C ξ i= = i= = (26) i( ( αk αk) ( k, i) ( αk αk) ( k, i) ) ξi, =,,, k= k= L (27) y K x x K x x b i k k k k k k k k = = L (28) y ( ( α α ) K( x, x ) ( α α ) K( x, x ) b) ξ, i =,,, ξi 0, i =, L,, (29) ξ 0, =, L,, (30) Here we use ( αi αi) ( α α ) to repace w. i= = The ethod is siiar to that of previous section we coud transfor probe (26)ü(30) into sooth unconstraint optiization probe by introducing sooth function P ( Δ, λ) and P ( Δ, μ). in ααα,,, α, b, ξξ,, ( αi αi) ( α α ) i= = ( i( ( αk αk) ( k, i) ( αk αk) ( k, i) ), λ) i= k= k= C P y K x x K x x b (3) k k k i k k k = k= k= C P( P ( ( α α ) K( x, x ) ( α α ) K( x, x ) b), μ), λ) When λμ, is arge enough, above probe is siiar to probe(26) ü(30) consequenty, we coud create decision function after we got the optiu soution ( α, α, α, α, b, ξ, ξ, )of this probe. ( ) = sgn( αk αk) ( k, ) ( αk αk) ( k, ) ), k= k= (32) f x K x x K x x b Additionay, using this decision function to decide the category of the points in test set S. 2.4 Concusion Iproveent of TSVM a) Assue known trainingset T = {( x, y), L,( x, y) }, here n xi X = R, yi = {, }, i=, L, ; known test set S = { x,, L x n }, here xi X = R ; b) Choose suitabe paraeter C and C, choose suitabe kerne function K( x, x ); construct and find the unconstraint probe (3), thus got optiu soution ( ααα,,, α, b ); c) Create decision function:

6 92 M. Yan and Z. Liu ( ) = sgn( αk αk) ( k, ) ( αk αk) ( k, ) ) k= k= f x K x x K x x b Thereby, for any test point beongs to S, the decision function wi provide the category for it. 3 New Method on Network Intrusion Detection As the obective function of probe 3 has a continuous gradient and hesse atrix, as we as unconstrained, it can be soved by basic agorith to unconstrained probe. However its obective function is not convex function thus a nuber of oca optia soutions ay exist, and through the genera unconstrained agorith ay not acquire goba optia soution. In the foowing goba optia agorith siuated anneaing agorith wi be introduced to sove probe (3), and the ode wi be introduced to network intrusion detection. 3. Siuated Anneaing Agorith First, we wi introduce siuated anneaing agorith. Siuated anneaing agorith is a kind of rando search ethod known as Monte Caro ethod, which aows the obective function to have rando changes in the increasing direction. Therefore, siuated anneaing agorith can up out of oca iniu point. This agorith was proposed by Metropois as eary as 953, originated fro siuation to soid anneaing process. The anneaing process starts at a certain high enough teperature, and aost every rando otion are acceptabe under this teperature. Then the teperature decreases sowy according to soe cooing rue and tends to zero. Enough tie is needed for the syste to reach a stabe state at each teperature point, and finay paces in a state with owest energy, to obtain a reative goba optia soution to the optiization probe. In which, one soution x k to the optiization probe and its target vaue f(x k ) correspond to a soid icrostate k and its energy E k respectivey. The teperature T in the anneaing process is a contro paraeter decreasing by the agorith process. The agorith adopts Metropois acceptance criteria. In each step of the agorith, a new candidate soution generates randoy. If the new soution decreases the obective function, it is acceptabe; otherwise whether to accept it wi be decided in for of exponentia probabiity. Probabiity P to accept the new soution is: exp( Δf / T ) Δf > 0, p = (33) Δf 0. In which, Δf is the variation of obective function caused by rando disturbance and T represents teperature. Fro forua (33) we can see that for a given Δf, when T is reativey high, acceptance probabiity to the new soution which increases the function is arger than the probabiity when T is reativey ow. Thus the entire agorith keeps the iterative process of generate new soution udge accept or discard ti find the optia soution finay. The specific agorith is as foows: Agorith A. Siuated anneaing agorith a) Suppose k=0, T= T 0, in which T 0 is the initia teperature. Paraeter L and initia vaue x 0 are given;

7 A New Method of Transductive SVM-Based Network Intrusion Detection 93 b) Generate a new candidate x k by rando disturbance of x k ; c) Cacuate Δf = f(x k ) - f(x k ); d) If Δf 0, accept the new soution x k =x k. If the stop criteria is satisfied, the agorith stops and x= x k ; otherwise give a rando vaue λ in the range of 0 to obeying unifor distribution. If exp(-δf/t)>λ, accept the new soution x k =x k ; e) Suppose k=k, if k L, up to step b); f) Decrease T 0 according to teperature cooing rue. Suppose x 0 =x k and k=0, and up to step b). In the above agorith, paraeters we need to seect incude the initia teperature vaue T 0. Siuated anneaing agorith requires a arge enough T 0 to ensure uping out of the oca optia soutions, that is to ensure exp(-δf/t 0 ). Seection of a too arge T 0 wi cause a too ong agorith period, whie a too sa T 0 wi cause the agorith traps in the oca optia soution too eary. The other paraeters need to be seected are iteration ties L under each teperature, initia soution x 0. Besides the decreasing rue of teperature T aso needs to be known, generay taken as T k =βt k,0<β<; and the fina vaue of teperature, actuay the fina teperature vaue often chose as cose to Network Intrusion Detection As the widespread use of network, og data is very arge. Soe network attacks such as DNS spoofing, denia of service, port scanning, etc. are generay very difficut to be directy discovered. Using data ining technoogy, nora and abnora action ode can be acquired fro assive ogs, and then detect intrusion action [5]. Data ining technoogy coony used in intrusion detection syste incudes neura network, genetic agorith [6] and so on. There are aso researchers using support vector achine to conduct soe tests on actua intrusion detection [7]. In essence, intrusion detection is actuay a cassification probe, that is to separate the nora action data and abnora action data of users through detection. In which the data describing user action is often uti-index. The feasibiity of using support vector achine to conduct intrusion detection has been verified in [7]. As we focuses ony on behavior of the current user, thus hereby we attept to use iproved deduction support vector achine to discuss the new ethod of network intrusion detection. Data adopted in the test is a batch of network connection record set [8]. This batch of origina data is a recovered connection inforation based on the data obtained in IDS evauation by U.S. Defense Advanced Research Proects Agency (DARPA) in 998 [9], incuding 7 weeks network traffic with about 5 iion connection records, in which there were a arge nuber of nora network traffic and various attacks, thus has a strong representative. As the aount of data is significanty arge, here we ony seect attacks of DOS type to conduct our experients, and deterine the diension nuber of the probe is 8 according to detection attribute set needed by DOS type attack provided by [9]. 200 nora connection inforation data are extracted fro the origina data set as the positive-type set, and 200 DOS type attack connection

8 94 M. Yan and Z. Liu inforation data are extracted as the negative-type set, then the positive-type point set and negative-type point set are randoy separated into training set and test set according to soe ratio (6:4). C-support vector achine [0] and iproved deduction support vector achine are used respectivey to sove the cassification probe of the above coposition. When soving optiization probe in the iproved deduction support vector achine, siuated anneaing agorith introduced in ast section is used. Both odes adopt RBF kerne function. During the test, the paraeter C, C, as we as σ in RBF kerne function adopt utipe vaues respectivey. Given different cobinations of these paraeters, test the perforance of the two agoriths under different cobinations. Tabe 6. is a test resut under one group of the cobinations as C=C=00 and σ=2, in which detection accuracy is the ratio of correcty detected sapes in the test set to the tota nuber of sapes in the test set; fase positive rate is the ratio of nora sapes that are istaken detected to abnora sapes to tota nuber of nora sapes; detection rate is the ratio of detected abnora sapes to tota nuber of abnora sapes. Tabe. Resut coparison Detection Resut C SVC Agorith2.4 Detection Accuracy 79.9% 8.2% Fase Positive Rate 0.54% 0.47% Detection Rate 77.5% 80.% Data in the tabe indicate that, usage of iproved deduction support vector achine can obtain higher detection accuracy. Certainy, the test resut depends on rationa seection of paraeters. In practica appications, cross vaidation or LOO error ethod (can refer to [3]) can be adopted to deterine optia paraeters. 4 Concusion and Perspective With reference to the resuts of the said discussion, the detection precision of iproved transductive SVM instead of C-SVM is higher, indicating that ony by studying and creating SVM intentionay according to the particuarity of probes when using SVM to sove practica probes can it achieve ore desirabe effects of appication. As for soving the network intrusion probe, the resuts of detection can depend on the proper seection of paraeters besides the seection and study of the varieties of SVM. And in fact, it is avaiabe to adopt the cross vaidation or LOO err (see [3]) to deterine the optiized paraeter, which is aso one of the directions to study on transductive SVM in the future. Besides SVM, neura net and genetic agorith can be appied to conduct the network intrusion detection via the data extraction technoogy. And it is required to ake a study of these technoogies appied to the detection on network intrusion and ake coparisons between the, and even copare the with the detection ethods of other technoogies to further arguent the advantages of these new ethods, a of which are the probes requiring further studies on theory and practice.

9 A New Method of Transductive SVM-Based Network Intrusion Detection 95 References [] Jiang, J., et a.: Study and Review on Network Intrusion Detection. Journa of Software (200) [2] Nei, Y., et a.: Network Inforation Safety Technoogy. Science Press, Beiing (200) [3] Deng, N., Tian, Y.: Support Vector Machine - A New Method in Data Mining, pp , pp Science Press, Beiing (2004) (in Chinese) [4] Yan, M.: Support Vector Machines for Cassification and Its Appication. China Agricutura University, Beiing (2005) (Doctor s Degree Paper) [5] Lee, W., Stofo, S.: Data ining approaches for intrusion detection [EB/OL] ( / ), [6] Baainath, B., Raghavan, S.V.: Intrusion detection through earning behavior ode. Coputer Counication 24(2), (200) [7] Li, H., et a.: SVM-based Network Intrusion Detection. Journa of Coputer Research and Deveopent 40(6), 6 (2003) [8] [9] Lee, W., Stofo, S., Mok, K.W.: A dataining fraework for buiding intrusion detection edes. In: The 999 IEEE Syposiu on Security and Privary, Oakand, CA (999) [0] Deng, N., Tian, Y.: Support Vector Machine Theory, Agorith and Expansion, pp Science Press, Beiing (2009)