In-Depth Analysis of Combine Machine Learning and Open Source Security Tools to Enhance Host-Based Intrusion Detection

Abstract

Abstract Computer networks made the world a small village. However, this sophisticated and ever-growing communication network suffers from rapidly increasing attacks (intrusions). Various solutions with low detection rates, high false alarms, high processing time, large trace sizes, and other challenges. In this paper, we proposed a model for combining machine learning and open-source security tool for host-based intrusion detection systems based on the anomaly-based technique and the signature or misuse-based approaches. We applied machine learning algorithms using Australia Defense Force Academy Linux Data set for the anomaly-based technique. Features are selected from the ADFA-LD data set using N-gram based feature extraction mechanism. We have configured one of the host-based intrusion detection tools called open-source security for signature-based intrusion detection. The experimental result showed that the performance of the proposed model is promising in terms of detection rate, false-positive rate, and processing time. We applied three machine learning algorithms: SVM, KNN, and RF for binary and multi-classification, and we gained better performance in binary class classification than in multi-class classification. As the experimental result, the accuracy of SVM is 96.26% with a 5.1% false-positive rate (FPR), KNN is 96.71% with 3.28% FPR, and RF is 96.86% with 3.9% FPR.