Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion...

Area of Science:

• Statistical Process Control
• Machine Learning for Cybersecurity

Background:

• Multivariate control charts are vital for network intrusion detection but struggle with non-normal network traffic data, leading to false alarms.
• Conventional methods require data to follow normal distributions, limiting their effectiveness in real-world network monitoring.

Purpose of the Study:

• To propose a novel multivariate control chart, the SVDD-KDE, designed to effectively monitor network anomalies in non-normal data distributions.
• To enhance network intrusion detection systems (IDS) by improving the accuracy and reducing false positives.

Main Methods:

• Integration of Support Vector Data Description (SVDD) with Kernel Density Estimation (KDE) to create a non-parametric control chart.
• Utilizing SVDD distance for anomaly detection and KDE for estimating control limits in non-normal data.
• Simulation studies with synthetic datasets and analysis of the NSL-KDD benchmark dataset for IDS evaluation.

Main Results:

• The SVDD-KDE chart showed improved performance in detecting multivariate data shifts and higher accuracy in identifying outliers compared to conventional methods.
• When applied to an IDS, the SVDD-KDE chart achieved high accuracy (0.917) and AUC (0.915) with a low false positive rate.
• The method proved effective in monitoring network attacks, outperforming several other IDS-based control charts and machine learning algorithms.

Conclusions:

• The proposed SVDD-KDE multivariate control chart is a robust solution for network intrusion detection, particularly for non-normal data.
• This approach significantly enhances anomaly detection capabilities in network traffic, offering a valuable tool for cybersecurity.
• Despite a high computational cost, the SVDD-KDE method provides a reliable and accurate IDS with a reduced false positive rate.