Feature Extraction based Approaches for Improving the Performance of Intrusion Detection Systems

Transcription

1 , Mach 18-20, 2015, Hong Kong Featue Extaction based Appoaches fo Impoving the Pefomance of Intusion Detection Systems Long-Sheng Chen*, Jhih-Siang Syu Abstact In ecent yeas, the apid development of infomation and communication technology esults in too many loopholes in the netwo, and thus attacts lots of haces attacs. Intusion Detection System (IDS) has been developed to detect these attacs. Depending on diffeent data and analysis methods, this system will have diffeent detection methods. But, thee is no one model is absolutely effective. heefoe, this study will focus on impoving the classification pefomance of anomaly detection. In this study, we ll popose Local Latent Semantic Indexing (LLSI) and Local Kenel-Pincipal Component Analysis (LKPCA) based methods, which intoduce class infomation to featue extaction techniques. And the poposed methods will be integated into suppot vecto machine (SVM) to impove the pefomance of classification. Finally, KDD-NSL data set will be employed to testify the effectiveness of the poposed methods. Index ems Intusion Detection System, Featue Extaction, Latent Semantic Indexing, Kenel-Pincipal Component Analysis, Dimension Reduction. I I. INRODUCION nfomation and communication technology (IC) has become an indispensable pat of human life based on well-built infastuctue. No matte govenment, business o a vaiety of academic, medical, and othe oganizations, they inceasingly ely on IC. But, it also bings lots of secuity poblems and cisis. Lots of netwo attac tools can easily be found and downloaded on the Intenet. hough a vaiety of netwo vulneabilities and continuously developed new attac techniques and tools, it leads to cybe-attacs continue to evolve. So, this poblem cannot be undeestimated (Feng et al, 2014; Hubballi and Suyanaayanan, 2014; Govindaajan and Chandaseaan, 2012). o solve this poblem, intusion detection systems (IDS) have been fistly developed by Andeson (1980). Since then, vaious attac identification techniques have been poposed, such as ule-based, neual netwos, suppot vecto machines, Manuscipt eceived Januay 8, 2015; accepted Januay 22, his wo was suppoted in pat by the National Science Council of aiwan, R.O.C. (Gant No. MOS E MY3). *L.-S. Chen is an Associate Pofesso of Depatment of Infomation Management and Dean of Student Affais Office with the Chaoyang Univesity of echnology, aichung 41349, aiwan (phone: ext7752; fax: ; lschen@cyut.edu.tw). J.-S. Syu is a gaduate student with the Depatment of Infomation Management, Chaoyang Univesity of echnology, aichung 41349, aiwan ( s @gm.cyut.edu.tw ). and so on. Lots of well-constucted intusion detection systems have been developed and have been applied to eal wold compute systems (Mohammed and Sulaiman, 2012). But, 30 yeas has passed since Andeson s fist study. We cannot complete solve this poblem, mainly because of damatically advances in technology. Depending on data type and data analysis methods, IDS could be divided into seveal diffeent modes. Based on analytical methods, IDS can be divided into misuse detection and anomaly detection. he fome uses a nown attac signatue database, wheneve the login data match any featue, IDS will give alams. he latte uses nomative behavio model and then obseves behavios deviation. If the behavio is inconsistent with the model, IDS will give alams. he accuacy of misuse detection system is high, but it cannot detect unnown attacs. Anomaly detection methods have high false alam ate, but it s able to detect unnown attacs (Hubballi and Suyanaayanan, 2014). So, no single one intusion detection system is applicable to any situation. In addition to a vaiety of algoithms and intusion detection system model, dimension eduction methods ae often used to select impotant featues and to educe dimension size fo saving computational cost. ypically, thee ae two goups of algoithms to epesent the featue space used in classification. he fist one is featue selection which is to select a subset of most epesentative featues fom the oiginal featue space. he second algoithm is featue extaction which is to tansfom the oiginal featue space to a smalle featue space to educe the dimension. hese dimension eduction techniques have widely applied to solve eal poblems. Fo examples, Eesa et al. (2015) used cuttlefish based featue selection techniques to maintain data quality featues and emove edundant and ielevant featues. Gan et al. (2013) combined with Patial Least Squae (PLS) featue extaction technique and Coe Vecto Machine (CVM) algoithm to detect the abnomalities. Kuang et al. (2014) using a suppot vecto machine (SVM) combined enel pincipal component analysis (KPCA) and genetic algoithm (GA), whee KPCA is used to educe the data dimension. o sum up, featue extaction which is one of dimension eduction method can poduce a new set of featues by tansfoming the oiginal input vaiables (Yang et al., 2011). But, the new set of featues cannot etain the oiginal meanings of oiginal featues (Jain et al., 2000). Liu et al. (2004) and Chen et al. (2008) indicated that featue extaction can educe the dimensions of the featue space geatly compaed with featue selection.

2 , Mach 18-20, 2015, Hong Kong Because the ange of intusion detection system is wide, the majo objective of this study is to focus on impoving the classification pefomance of anomaly detection. Latent Semantic Indexing (LSI) (Deeweste et al., 1990; Guan et al., 2013; Uysal and Gunal, 2012; Wang et al., 2015) and KPCA will be employed to integate into Suppot Vecto Machines (SVM) to incease the anomaly detection pefomance. In this study, we ll to popose a Local Latent Semantic Indexing (LLSI) by singula value decomposition (SVD) and Local Kenel-Pincipal Component Analysis (LKPCA) based methods which intoduce class infomation to featue extaction techniques. And the poposed methods will be integated into suppot vecto machine (SVM) to impove the pefomance of classification. Finally, KDD-NSL data set will be employed to testify the effectiveness of the poposed methods. II. LIERAURE REVIEW A. Intusion Detection Systems hose unauthoized activities which have been designed to access system esouces o data ae called intusion (Hubballi and Suyanaayanan, 2014). he main coe of intusion detection system is to be able to detect these attacs o illegal activities to povide netwo manages coesponding teatment. he IDS can be classified into seveal diffeent modes accoding to its data souce and analytic methods. able 1 shows the categoy of IDS. Usually, we build IDS in the font end of a netwo segment, o behind/afte the fiewall, to analyze pacet though the inspected netwo section. In 30-yea histoy of IDS, ule-based ealy detection module has been fistly developed and become the main steam (Han, 2003; Lee, 1999). Afte then, diffeent algoithms based detection methods, such as genetic algoithm (GA) (Kuang et al., 2014), Bayes (Benfehat et al., 2013), neual netwos (NN) (homas and Balaishnan, 2008), and suppot vecto machine (SVM) (Feng et al, 2014; Mohammed and Sulaiman, 2012) have been constucted. ABLE I IDS CLASSIFICAION Classification Species Monitoing objectives and appoach. Netwobased Monitoing netwo pacets. Intenal ecods monitoing activities of Host-based Souces of the host system. infomation to Application distinguish -based Log file monitoing application geneated. Goal-based Monitoing special o secet achives. Hybid Monitoing netwo pacets and host systems combined ecod of activities. Analytical methods to distinguish Misusebased Anomalybased Hybid Uses a database of nown attac signatues, wheneve the login data match any featue, IDS will give alams. Nomative system behavio and obsevable deviations ae aised as alams. Combines signatue-based and anomaly-based appoach enables them to complement each othe. ill now, in ode to cope with the apid development of infomation technology, single one type of models has been insufficient to potect netwo secuity. So, the hybid appoaches gadually become the mainsteam (Kim and Kim, 2014). False positives (FP) is the most common indicatos in assessing the quality of an IDS. And, how to educe the so-called false positive ate in this field has become one of impotant issues (Hubballi and Suyanaayanan, 2014). Howeve, the eal pupose of this study is not to build complete IDS, but how to impove the classification pefomance. Kuang et al. (2014) pointed out that the intusion detection can be seen as essentially a classification poblem to distinguish abnomal activities. hus, the study focuses on the emphasis on the use of data mining techniques to detect abnomal pattens of classification pefomance, hoping to impove thei pefomance though effective data mining techniques. B. Featue Extaction Accoding to available liteatues, lots of wos used vaious featue extaction methods fo dimension eduction (Hoque and Bhattachayya, 2014; Lin et al., 2012). he most epesentative featue extaction algoithm is the Latent Semantic Indexing (LSI) (Deeweste et al., 1990; Guan et al., 2013; Uysal and Gunal, 2012; Wang et al., 2015) which is an automatic method that tansfoms the oiginal textual data to a smalle semantic space by taing advantage of some of the implicit highe-ode stuctue in associations of wods with text objects (Bey et al., 1995; Deeweste et al., 1990). he tansfomation is computed by applying tuncated singula value decomposition (SVD) to the tem-by-document matix. Afte SVD, tems which ae used in simila contexts will be meged togethe. SVD is an optimal linea tansfomation fo dimensionality eduction. It allows the aangement of the space to eflect the majo associative pattens in the data, and ignoe the smalle, less impotant influences. SVD tansfomation as well has the advantage of yielding zeo-mean and uncoelated featues (Castelli et al., 2003). Moeove, it has been epoted that SVD can be applied to education, solving linea least-squaes poblems, data compession (Aitas and Malaschono, 2004), document classification (Guan et al., 2013), and text classification (Uysal and Gunal, 2012). heefoe, LSI is employed as the featue extaction tool in this study. Anothe famous featue extaction method is Pincipal Component Analysis (PCA). PCA method can only extact the linea stuctue infomation in the data set, howeve, it cannot extact this nonlinea stuctue infomation. Except intusion detection, thee ae lots of successful applications in many aeas, such as face ecognition, stoc pediction model, and so on (Zhou et al, 2014; Kuang et al, 2014; Wang and Battiti, 2006;Wen et al ). KPCA (Scholopf et al., 1998) is an impoved PCA, which extacts the pincipal components by adopting a nonlinea enel method. A ey insight behind KPCA is to tansfom the input data into a high dimensional featue space F in which PCA is caied out, and in implementation, the implicit featue vecto in F does not need to be computed explicitly, while it is just done by computing the inne poduct of two vectos in F with a enel function (Kuang et al., 2014). Using non-linea enel function, KPCA impove the nonlinea poblems which cannot be solved by PCA (Chen et al, 2008; Ding et al, 2009). he main advantage of KPCA is that it does not involve nonlinea optimization; essentially it only equies linea algeba, which maes it as simple as standad PCA (Jia et al., 2012). KPCA equies only the

3 , Mach 18-20, 2015, Hong Kong solution of an eigenvalue poblem, and due to its ability to use diffeent enels, it can handle a wide ange of nonlineaities. In addition, KPCA does not equie the numbe of components to be extacted and specified pio to modeling. Due to these advantages, this study employs KPCA and compae its esults to LSI. III. IMPLEMENAL PROCEDURE he expeimental pocedue is divided into two stages, the fist stage, we use featue extaction methods to educe dimensionality. he oiginal 41 featues will be educed to smalle dimensionality. In the second phase, we find the optimal educed dimension size though evaluating by SVM classifie. he implemental pocedue can be shown in Figue 1. Actually, thee ae 6 majo steps. he concise steps can be found as follows. FIGURE 1 HE IMPLEMENAL PROCEDURE OF HIS WORK Step 1: Data Collection he employed tain20pecent data comes fom KDD-NSL data sets (Nsl-dd, 2009). his data set is used to detect intusion, and povided by well-nown public data sets KDD CUP 99 (Hettich and Bay, 1999). It s modified fom KDD CUP 99, and impove some disadvantages of oiginal data (avallaee et al., 2009). Step 2: Data Pepocessing In tain20pecent dataset, the attac type has been categoized 23 types. We combine all 23 attacs into one class abnomal. heefoe, it has become binay class classification poblems. Step 3: Featue Extaction his study uses 4 featue extaction methods, Global LSI, Local LSI, Global KPCA, and Local KPCA. Global LSI and Global KPCA mean the oiginal LSI and KPCA without intoducing class infomation. Local LSI and Local KPCA ae ou pesented methods. Step 3.1 LSI Let s biefly intoduce the concept of SVD. Let A be a m n matix of an whose ows epesent documents and columns denote tems (vaiables). Let the singula values of A (the Eigen values of A A ) be he singula value decomposition of A expesses A as the poduct of thee matices A USV, whee S diag( 1,..., ) is an matix, U (u1,..., u ) is an m matix whose columns ae othonomal, and V (v1,..., v ) is an n matix. LSI wos by omitting all but the lagest singula values in the above decomposition, fo some suitable ( is the dimension of the low-dimensional space). It should be small enough to enable fast etieval and lage enough to adequately captue the stuctue of the copus. Let S diag( 1,..., ), U (u1,..., u ) and V (v1,..., v ). hen A U SV is a matix of an, which is the appoximation of A. he ows of V S above ae then used to epesent the documents. In othe wods, the ow vectos of A ae pojected to the -dimensional space spanned by the ow vectos of U ; we sometimes call this space the LSI space of A. We implement Global LSI and Local LSI. Global LSI is the geneal method of using SVD. We can choose the educed dimension size, and then we use M U S to be a new set of input featues. In Local LSI (Liu et al., 2004), we fist divide data into seveal goups based on thei class labels. Next, we implement the same pocedue with Global LSI. So, Local LSI intoduces the additional infomation of class (dependent vaiables) while tansfoming. Step 3.2 KPCA Global KPCA Step Collect data X, and nomalize the data of each n m vaiable into mean 0 and vaiance 1. I I Step Compute the enel matix K R, note the elements as K. ij Step Cay out centeing in the featue space fo K. Step Cay out pincipal component decomposition fo, and detemine the numbe of PCs etained, ecoded as A, and then pojection is obtained. Local KPCA Step Collect data X, and nomalize the data of each n m vaiable into mean 0 and vaiance 1. Step Divide collected data into seveal goups based on thei class labels. Fo each goup, we implement sub-steps 3.3.3~3.3.5, espectively. I I Step Compute the enel matix K R, note the elements as K. ij Step Cay out centeing in the featue space fo K. Step Cay out pincipal component decomposition fo, and detemine the numbe of PCs etained, ecoded as A, and then pojection is obtained. Step 4 Build SVM classifie In ode to confim the pefomances of poposed Local LSI and Local KPCA, we use the educed dimensionality to build SVM. In this step, we use the taining data to constuct SVM classifie, and then input the test data to validate the built classifies. Moeove, 5 fold coss validation expeiment has been employed fo these taining data. Step 5 Results Evaluation We use oveall accuacy (OA) and F1 to evaluate the pefomances.

4 , Mach 18-20, 2015, Hong Kong Step 6 Daw Conclusions Based on esults, we can mae conclusion. A. Data Pepocessing IV. RESULS In this study, we employ tain20pecent file fom NSL-KDD (Nsl-dd, 2009). In this dataset, the attac type has been categoized in able 2. Besides, able 3 shows the data size and class distibution infomation. By the way, we define 4 attac types into one abnomal class. heefoe, it has become binay class classification poblems. In addition, 5 fold coss validation expeiment has been employed. All data will be nomalized. Attac ype U2R R2L DOS Pobe ABLE II AACK YPES IN NSL-KDD DAASE Attac detailed classification Buffe_oveflow, loadmodule, multihop, pel, ootit ftp_wite, guess_passwd, imap, phf, spy, waezclient, waezmaste ftp_wite, guess_passwd, imap, phf, spy, waezclient, waezmaste Ipsweep, nmap, potsweep, satan 2*Pecision*Re call F1 (4) Pecision Re call he oveall accuacy (OA) has been defined in equation (1). F1 is a weighted index both consideing Pecision and Recall indicatos. Pecision, Recall, F1 can be defined in equations (2)~(4). C. Expeimental Results Figue 2 povides the summay of esults when using LSI. Fom this figue, we can find that the pefomance of Global LSI and Local LSI eep stable when dimension size deceasing. But, even when the dimension size educe fom oiginal 41 attibutes to 1 attibutes, Local LSI has bette pefomance than Global LSI no matte consideing OA o F1. (a) (b) ABLE III DAA DISRIBUION Expeiment No. Data size Class distibution Fold-1 Fold-2 Fold-3 Fold-4 Fold-5 B. Measuement Index 25,192 Nomal:13,449 Attac:11,743 o illustate measuement index, we use table 4 to demonstate accuacy and F1. (a) FIGURE 2 RESULS OF GLOBAL LSI AND LOCAL LSI ABLE IV BINARY CLASSIFICAION Pedicted Nomal Pedicted Attac Actual Nomal P FP Actual Attac FN N (b) In able 4, the meanings of denotations P, FP, FN, N have given as follows. (1) P: Actual nomal examples classified into nomal. (2) FP: Actual nomal examples classified into attac. (3) FN: Actual attac examples classified into nomal. (4) N: Actual attacs examples classified into attac. P N OA (1) P FP N FN P P ecision (2) P FP P Re call (3) P FN FIGURE 3 RESULS OF GLOBAL KPCA AND LOCAL KPCA Figue 3 povides the summay of esults when using KPCA. Fom this figue, unlie LSI, we can find that the pefomance of Global KPCA gets wose when dimension size deceasing. But, even when the dimension size educe fom oiginal 41 attibutes to 1 attibutes, Local KPCA significantly outpefom Global LSI no matte consideing OA o F1. able 5 gives the compaison of oiginal SVM, Global

5 , Mach 18-20, 2015, Hong Kong LSI, and Local LSI. Fom this table, we can find the computational time save up to 98% no matte implementing Global LSI o Local LSI. But, Local LSI can maintain the classification pefomance. able 6 shows the compaisons of oiginal SVM, Global KPCA, and Local KPCA. Consideing computational time, Global KPCA and Local KPCA only use 1.34% and 0.017%, espectively. Local KPCA significantly outpefom oiginal SVM no matte in OA and F1. Fom ables 5~6, we can find that intoducing class infomation to featue extaction methods can not only eep the classification pefomance, but also emaably educe the computational time. OA (%) F1 (%) ime ABLE V COMPARISONS OF ORIGINAL SVM, GLOBAL LSI AND LOCAL LSI Oiginal (dimensions 41) (0.06) (0.05) 345, (12.25) Global LSI- SVM (23.90) (15.38) 7, (29.62) Local LSI- SVM (0.17) (0.16) 7, (0.15) Note: he numbe (0.06) in this table means Mean (Standad Deviation), espectively. ABLE VI COMPARISONS OF ORIGINAL SVM, GLOBAL KPCA AND LOCAL KPCA Oiginal (dimensions 41) Global KPCA Aveages Local KPCA (Standad Deviation) OA (%) (0.06) F1 (%) (0.05) 345, , ime (12.25) (19.19) (10.00) Note: he numbe (0.06) in this table means Mean (Standad Deviation), espectively. V. CONCLUSIONS In the pesent study, we utilize featue extaction selection method (LSI, KPCA) to impove the pefomance of intusion detection systems. By intoducing class infomation, we pesent Local-LSI and Local-KPCA. Results indicated that Local-LSI and Local-KPCA outpefom Global LSI and Global KPCA, and oiginal SVM, espectively. Local-KPCA cannot only damatically save computational time, but also emaably incease the classification pefomance. We can conclude that intoducing class infomation to featue extaction methods can not only eep the classification pefomance, but also emaably educe the computational time. Howeve, the esults obtained fom one data set. If we want to have a genealized conclusion, moe data sets and additional featue extaction methods can be used in the futue wos. Multi-class classification might be anothe one diection of futue eseaches. REFERENCES [1] A. S. Eesa, Z. Oman, A. M. A. Bifcani, A novel featue-selection appoach based on the cuttlefish optimization algoithm fo intusion detection systems, Expet Systems with Applications 42 (2015) [2] B. Scholopf, A. Smola, K. R. Mulle, Nonlinea Component Analysis as a Kenel Eigenvalue Poblem, Neual Computation 10(5) (1998) [3] C. homas, N. Balaishnan, Pefomance enhancement of intusion detection systems using advances in senso fusion, in: Fusion 08: Poceedings of the 11th Intenational Confeence on Infomation Fusion, (2008) [4] C. Zhou, L. Wang, Q. Zhang, X. Wei, Face ecognition based on PCA and logistic egession analysis, Opti - Intenational Jounal fo Light and Electon Optics,125:20(2014) [5] C.-C. Chen, L.-S. Chen, C.-C. Hsu,, and W.-R. Zeng, (2008) An infomation ganulation based data mining appoach fo classifying imbalanced data, Infomation Sciences, 178 (16): [6] F. Kuang, W. Xu, Zhang, S., A novel hybid KPCA and SVM with GA model fo intusion detection, Applied Soft Computing 18(2014) [7] F. Wen, J. Xiao, Z. He, X. Gong, Stoc Pice Pediction based on SSA and SVM, Pocedia Compute Science 31(2014) [8] G. Aitas, G. I. Malaschono, (2004). Applications of singula-value decomposition (SVD). Mathematics and Computes in Simulation, 67, [9] G. Kim, S. Lee, S. Kim, A novel hybid intusion detection method integation anomaly detection with misuse detection, Expet Systems with Applications 41(2014) [10] H. Guan, J. Zhou, B. Xiao, M. Guo,. Yang, (2013). Fast dimension eduction fo document classification based on impecise spectum analysis. Infomation Sciences, 222, [11] J. Wang, J. Peng, Q. Liu, (2015). A classification appoach fo less popula webpages based on latent semantic analysis and ough set model. Expet Systems with Applications, 42(1), [12] K. Bhattachayya, J. K. Kalita, Netwo anomaly detection: A machine leaning pespective, (2013),CRC Pess. [13] K. Jain, R. P. W. Duin, and J. Mao, (2000). Statistical patten ecognition: A eview, IEEE ansactions on Patten Analysis and Machine Intelligence, 22(1): [14] K. Uysal, and S. Gunal, (2012). A novel pobabilistic featue selection method fo text classification. Knowledge-Based Systems, 36, [15] M. Ding, Z. ian, H. Xu, Adaptive enel pincipal analysis fo online featueextaction, Poc. Wold Acad. Sci. Eng. echnol. 59 (2009) [16] M. Govindaajan, R. M. Chandaseaan, Intusion Detection using an Ensemble of Classification Methods, Poceedings of the Wold Congess on Engineeing and Compute Science (2012 )WCECS. [17] M. Jia, H. Xu, X. Liu, N. Wang, he optimization of the ind and paametes of enel function in KPCA fo pocess monitoing, Computes and Chemical Engineeing 46 (2012) [18] M. N. Mohammed, N. Sulaiman, Intusion Detection System Based on SVM fo WLAN, Pocedia echnology 1(2012) [19] M. avallaee, E. Baghei, W. Lu, and A. A. Ghobani, A Detailed Analysis of the KDD CUP 99 Data Set, poceedings of the 2009 IEEE Symposium on Computational Intelligence in Secuity and Defense Applications (CISDA 2009). [20] M.W. Bey, S.. Dumais, and G. W. O'Bien, (1995). Using linea algeba fo intelligent infomation etieval. SIAM Review, 37, pp [21] N. Hoque, D. K. Bhattachayya, J. K. Kalita, MIFS-ND: A mutual infomation-based featue selection method, Expet Systems with Applications 41 (2014) [22] N. Hubballi, V. Suyanaayanan, False alam minimization techniques in signatue-based intusion detection systems :A suvey, Compute Communications 49(2014)1-17 [23] Nsl-dd data set fo netwo-based intusion detection systems. Available on: Mach [24] P. Andeson, Compute Secuity heat Monitoing and Suveillance, Box 42 Fot Washington, Pa ,215(1980) [25] S. Benfehat, A. Boudjelida, K. abia, H. Dias, An intusion detection and alet coelation appoach based on evising pobabilistic classifies using expet nowledge, Int. J. Appl. Intell. 38 (4) (2013)

6 , Mach 18-20, 2015, Hong Kong [26] S. Deeweste, S.. Dumais, G. W. Funas,. K. Landaue, R. Hashman, Indexing by latent semantic analysis, Infomation Science,(1990) [27] S. Han, S. Cho, Rule-based integation of multiple measue-models fo effective intusion detection Systems, IEEE Intenational Confeence 1. 6(2003) [28] S. Hettich, S. D. Bay, he UCI KDD Achive [ Ivine, CA: Univesity of Califonia, Depatment of Infomation and Compute Science(1999). [29] S. W. Lin, K. C. Ying, C. Y. Lee, Z. J. Lee, An intelligent algoithm with featue selection and decision ules applied to anomaly intusion detection, Applied Soft Computing, 12(10) (2012) [30]. Liu, Z. Chen, B. Zhang, W. Ma, G. Wu, Impoving text classification using local latent semantic indexing, In Poceedings of he Fouth IEEE Intenational Confeence on Data Mining, Bighton, UK, Novembe 01-04, 2004 [31] V. Castelli, A. homasian, C.-S. Li, (2003). CSVD: Clusteing and Singula Value Decomposition fo appoximate similaity seach in high-dimensional spaces. IEEE ansaction on Knowledge and Data Engineeing, 15 (3), [32] W. Feng, Q. Zhang, G. Uu, J. X. Huang, Mining netwo data fo intusion detection though combining SVMs with ant colony netwos, Futue Geneation Compute Systems 37 (2014) [33] W. Lee, S. J. o. Stolf, K. W. Mo, A data mining famewo fo building intusion detection models. Poceedings of the 1999 IEEE Symposium Secuity and Pivacy 13(1999) [34] W. Wang, R. Battiti, Identifying intusions in compute netwos with pincipal component analysis, in: ARES 06:Poceedings of the Fist Intenational Confeence on Availability Reliability and Secuity (2006) [35] W. Yang, C. Sun, L. Zhang, (2011) A multi-manifold disciminant analysis method fo image featue extaction, Patten Recognition, 44 (8), [36] X. S. Gan, J. S. Duanmu, J. F. Wang, Cong, W., Anomaly intusion detection based on PLS featue extaction and coe vecto machine, Knowledge-Based Systems 40 (2013) 1 6. [37] Z. G. Chen, H. D. Ren, X. J. Du, Minimax pobability machine classifie with featueextaction by enel PCA fo intusion detection, Wieless Communications,Netw. Mobile Comput. (2008) 1 4.