Intrusion Detection System based on Hybrid Classifier and User Profile Enhancement Techniques

This paper presents a user intrusion detection system based on hybrid classifier and profile enhancement techniques. The proposed approach is an anomaly-based intrusion detection system that uses supervised learning based on event logs. A standard user profile is first built on the historical log data. This user profile is then used to detect anomalous user behavior by comparing it against the new log data. The intrusion detection system is designed as a hybrid classifier using Naïve Bayes and Support Vector Machine (SVM). The results from the hybrid classifier show improved accuracy and reduced false positives. Furthermore, the user profile is enhanced by adding a new set of features. It is observed that using session based features to enhance the user profile improved the performance of the classifier. The experiments are conducted on historical log data from two different sources and in both the cases a performance improvement is observed. In the case of a hybrid classifier, an accuracy of 0.929 and a precision of 0.953 is observed. While after the enhancement of the user profile, accuracy and precision increased to 0.931 and 0.958 respectively.