Reduced Dimensionality for Network Intrusion Detection using Principal Component Analysis

Abstract: Intrusion Detection System (IDS) is the science of detection of malicious activity on a computer network. Due to the enormous volume existing and newly appearing network data, Data Mining classification methods are used for Intrusion Detection System. In this paper the classifying methods used are ID3, SVM, Decision Tree and One R. The data set used for this experiment is kddcup1999. The dimensionality reduction is being performed from 41 attributes to 6 and 14 attributes based on Principal Component Analysis and the 4 classifying methods are being applied. The result shows SVM method carries the highest accuracy and sensitivity with 6 and 14 attributes. J4.8 and ID3 holds the highest degree of specification for all three dimensionalities. One R has the worst Sensitivity with 6 and 14 attributes but the time taken by One R for classification is very less. It is found that the optimal algorithm may vary based on the dimensionality. Our approach focuses on using information obtained Kdd Cup 99 data set for the selection of attributes to identify the type of attack. Our work then compares the performance of the classification models by a randomly selected initial dataset with the reduced dimensionality. Furthermore, the results indicate that our approach provides more accurate results compared to the purely random one in a reasonable amount of time.

Keywords: IDS, Mining, ONER, SVM, PCA, KDD Cup99 dataset.