Enhancing Network Security with a Hybrid Intrusion Detection System Using SVM

Abstract

Networks are rapidly and inevitably becoming complex, also the number of cyber threats is rising. Technology that uses intrusion quote elimination methods is essential to most networked forms for intentional analysis. The paper provides a thorough analysis of a modest version of a suggested system that use Support Vector Machines (SVM) to address networking anomaly and misuse detection in the face of insurmountable obstacles. The method uses both abnormality detection, which is extremely useful for identifying novel and 0-day attacks, and misuse detection, which is more effective in the detection of known attack patterns. Support Vector Machines is applied in building the system that achieves excellent accuracy in classification of network traffic, and at the same time reducing false negative and false positive rates. The hybrid model is the approach through which data-driven analytics is performed on raw network traffic data to extract relevant features, which are then used at run-time for classification by use of SVM. Anomaly detection aims at discovering deviations originating from standard network behavior, whereas misuse detection employs aspects of known signatures attack. This anomaly or misuse based systems outperform state-of-the-art models with respect to accuracy 97.1 in all other parameters such as precision, recall, as well as the f1 score. Among the other positive aspects of this work is the possible use of SVM in hybrid intrusion detection frameworks foreseeing an all-encompassing solution to modern network security issues. The research will further consider utilization of adaptive learning in order to improve persistency of the system against learning to new threats. Keywords:- Behavioral Anomaly Detection, Explainable Artificial Intelligence, Ensemble Learning, Anomaly Detection, Attack Classification