네트워크 침입탐지를 위한 계층적 하이브리드 모형

Abstract

Machine learning is actively applied to network intrusion detection and various network intrusion detection models have been proposed. Network intrusion detection models can consist of multiple algorithms, and these algorithms can be organized into ensembles or hybrid styles. A hybrid model structure is proposed with a case model exemplifying the proposed structure. The case model consists of a two-layer hierarchical model. The lower layer includes multiple classification models constructed from a single algorithm using the same training data. The upper layer model utilizes the results of the lower-layer models as part of the input data with a aggregating function. The model is evaluated showing its performance by comparing with models using single algorithm. It shows higher value particularly in recall. In cases of relatively low-frequency intrusion types, it shows higher precision and f1-score with the exception of one intrusion type (perl). Despite its better detection scores, the model in this paper is somewhat experimental. Therefore, further research would be helpful regarding the validity of the selection of individual algorithms constituting the overall model and the aggregating function for the results of lower-level models.