Scaling up Detection Rates and Reducing False Positives in Intrusion Detection using NBTree

In this paper, we present a new learning algorithm for anomaly based network intrusion detection using improved self adaptive naive Bayesian tree (NBTree), which induces a hybrid of decision tree and naive Bayesian classifier. The proposed approach scales up the balance detections for different attack types and keeps the false positives at acceptable level in intrusion detection. In complex and dynamic large intrusion detection dataset, the detection accuracy of naive Bayesian classifier does not scale up as well as decision tree. It has been successfully tested in other problem domains that naive Bayesian tree improves the classification rates in large dataset. In naive Bayesian tree nodes contain and split as regular decision-trees, but the leaves contain naive Bayesian classifiers. The experimental results on KDD99 benchmark network intrusion detection dataset demonstrate that this new approach scales up the detection rates for different attack types and reduces false positives in network intrusion detection.