Design and Performance Evaluation of a Machine Learning-Based Method for Intrusion Detection

In addition to intrusion prevention, intrusion detection is a critical process for network security. The task of intrusion detection is to identify a network connecting record as representing a normal or abnormal behavior. This is a classification problem that can be addressed using machine learning techniques. Commonly used techniques include supervised learning such as Support Vector Machine classification (SVM) and unsupervised learning such as Clustering with Ant Colony Optimization (ACO). In this paper, we described a new approach that combines SVM and ACO to take advantages of both approaches while overcome their drawbacks. We called the new method Combining Support Vectors with Ant Colony (CSVAC). Our experimental results on a benchmark data set show that the new approach was better than or at least comparable with pure SVM and pure ACO on the performance measures.