GRD Journals | Global Research and Development Journal for Engineering | International Conference on Innovations in Engineering and Technology

(ICIET) - 2016 | July 2016

e-ISSN: 2455-5703

An Efficient Extreme Learning Machine based

Intrusion Detection System
1W.

Sylvia Lilly Jebarani 2K. Janaki 3R. Anupriya

1
AP- Senior Grade 2,3UG Scholar
1,2,3
Department of Electronics and Communication Engineering
1,2,3
Mepco Schlenk Engineering college, Sivakasi, India
Abstract
This paper presents an intrusion detection technique based on online sequential extreme learning machine. For performance
evaluation, KDDCUP99 dataset is used. In this paper, we use three feature selection techniques filtered subset evaluation, CFS
subset evaluation and consistency subset evaluation to eliminate redundant features. Two network traffic profiling techniques are
used. Alpha profiling is done to reduce time complexity and beta profiling is used to remove redundant connection records and
hence reduce the size of dataset
Keyword- Network traffic profiling, OS-ELM
__________________________________________________________________________________________________

I. INTRODUCTION
In recent years of advanced technologies, networks are facing many threats. One among them is intrusion. It affects networks by
consuming more bandwidth and other resources. Thus the need of this hour is detecting intrusions. It can be done by analyzing
the network traffic dataset. But it is difficult to process large dataset. So network traffic behavior can be used for intrusion
detection.
The proposed technique considers issues like hugeness of dataset, low accuracy and time complexity. OS-ELM processes
network traffic dataset to detect intrusions. It is fast and accurate in classification.
The previous intrusion detection techniques use support vector machines for classification. It has the inability of
classifying new type of connection records for which it is not trained. In this proposed technique, we use extreme learning
machine for classification. It is trained by using training dataset and it learns itself and classifies new type of connection records.
The standard KDDCUP99 dataset is used for performance evaluation of this proposed technique. It has about 5 million
connection records.
Three feature selection techniques are used to remove redundant features which reduce the accuracy of the classifier.
The techniques are filtered subset evaluation, CFS subset evaluation and consistency subset evaluation. By selecting appropriate
features, the accuracy of classification is improved.
10 fold cross validation technique is used to divide the dataset into training and testing dataset. The dataset is divided into 10 sets
and 10 iterations are done. Every time, one set is used for testing and 9 for training. This is repeated 10 times.
Alpha profiling is a network traffic profiling technique which reduces the time complexity by grouping connection
records which have same protocol type and service into a single alpha feature. This reduces the time complexity of the classifier.
Some of the advantages of using alpha profiling are increased scalability, load balancing and handling unknown profiles.
Beta profiling is another network traffic profiling technique which reduces the size of dataset. The similar connections records
are grouped together by using a clustering algorithm namely DBSCAN and the centre of these clusters are combined and used as
dataset.
Online sequential extreme learning machine classifier is used for classification. It is fast and accurate compared to other
previously used classifiers. This classifier detects intrusion in the network.

II. DATASET DESCRIPTION

25,000 connection records were chosen from the KDDCup99 dataset. The dataset consists of 41 features and one class label. The
class label indicates whether the record is normal or anomalous. The features are as shown in Table 1.

All rights reserved by www.grdjournals.com

297

An Efficient Extreme Learning Machine based Intrusion Detection System

(GRDJE / CONFERENCE / ICIET - 2016 / 048)

Table 1: List of features in KDDCup99 Dataset

III. METHODOLOGY
Fig.1 shows methodology of the proposed system. The experiment is carried out using MatLab(version R2014a) and Weka data
mining tool.
The blocks involved are explained below:
A. Dataset Pre-processing
The KDDCup99 dataset contains both categorical and continuous features. Since classifier cannot compute categorical features,
the dataset must contain only continuous features.

All rights reserved by www.grdjournals.com

298

An Efficient Extreme Learning Machine based Intrusion Detection System

(GRDJE / CONFERENCE / ICIET - 2016 / 048)

Fig. 1: Proposed Intrusion Detection System

B. Feature Selection
Space and time complexity can be reduced by feature selection technique. It is carried out using Weka tool. After analysis with
different evaluation techniques, it is found that Filtered subset evaluation, consistency subset evaluation, CFS subset evaluation
are the three feature selection techniques that provides optimal subset of features. By reducing the number of features, accuracy
is increased.
C. Cross Validation
10-fold cross validation technique is used in this system. The whole dataset is divided randomly into 10 parts. Here, 9 parts are
used for training and the remaining one part is considered for testing. Maximum error estimation is done using 10-fold crossvalidation.
D. Alpha Profiling
Based on the protocol and service features of connection records, profiles are created. This process is called Alpha profiling.
Combination of a protocol and service is termed as an alpha feature. Connection records are separated based on each feature and
the groups are called Alpha profiles. The main advantages of this process are as below:
Increased scalability and load balancing.
Reduces number of comparisons
Efficient handling of unknown profiles
Reduces protocol service imbalances.

All rights reserved by www.grdjournals.com

299

An Efficient Extreme Learning Machine based Intrusion Detection System

(GRDJE / CONFERENCE / ICIET - 2016 / 048)

E. Beta Profiling
IDS use more detection time for processing the large dataset. In order to rectify this problem, beta profiling is introduced. This
process is also called Sample reduction process. This process also reduces memory requirement and time complexity. Density
based clustering of applications with noise (DBSCAN), a clustering algorithm is used for the implementation of this process.
This groups similar connections removing redundant records resulting in quality samples only.
F. OS-ELM:
In our proposed methodology, OS-ELM classifier is used for intrusion detection. It overcomes the slow learning limitation of
other classifiers. It is capable of solving several classification problems and process large dataset in a very less time.
G. Result Aggregation:
The results obtained from every process are analysed and compared with other existing classifier performances.

IV. RESULTS
Results of each experiment is presented in this section and analysed as given below:
A. Pre-processing
In this process, the nominal values were first converted into numerical values and then normalized. This was performed using
Matlab.
B. Feature Selection
The output of pre-processing is fed into Weka data mining tool for feature selection. Three techniques mentioned above were
used. The result of this process is as shown in Table 2.

Table 2: List of Selected features

C. Alpha Profiling
Alpha profiling is done using Matlab code. The output file consisted of 17 alpha profiles. The list of alpha profiles is as shown
below:

All rights reserved by www.grdjournals.com

300

An Efficient Extreme Learning Machine based Intrusion Detection System

(GRDJE / CONFERENCE / ICIET - 2016 / 048)

D. Beta Profiling
Using Matlab, the normal and anomalous connections records were separated. Then, based on DBSCAN algorithm, parameters
(distance threshold and minimum number of connections) are set and thus beta profiles are created. After beta profiling, the size
of the dataset got reduced by 10%.

V. PERFORMANCE ANALYSIS
The results obtained were fed into Support Vector Machine (SVM) and Sequential minimal optimization(SMO). The accuracy
values obtained are as shown in Table 3.

Table 3: Performance comparison using SVM and SMO classifiers

From the analysis of the tabulated results, the inferences are summarized as below:
1) After feature selection process, the dimensions have reduced by 52.38% of the original dataset. Thus, time consumption is
reduced.
2) From Table 1 it is found that accuracy is retained the same after alpha profiling but it accounts for reducing the number of
comparisons.
3) Accuracy is increased after beta profiling process. It reduces the size of the dataset thus reducing time and space complexity.

REFERENCES
[1] Adetunmbi A.Olusola., Adeola S.Oladele. and Daramola O.Abosede, Analysis of KDD 99 Intrusion Detection Dataset for
Selection of Relevance Features, World Congress on Engineering and Computer Science 2010, Vol I.
[2] Singh.R.,Kumar, H., &Singla. R. K(2014), TOPSIS based multi-criteria decision making of feature selection techniques for
network traffic dataset, International Journal of Engineering and Technology,5(6),4598-4604.
[3] Chia-Ming Wang, Yin-Fu Huang, Evolutionary-based feature selection approaches with new criteria for data mining: A
case study of credit approval data, April 2009.
[4] Ester,M., Kriegel, H.P., Sander,J.,&Xu,X.(1996),A Density-based algorithm for discovery clusters in large spatial
databases with noise, Second International Conference on Knowledge Discovery and data Mining(pp.226-231).
[5] S. Revathi., A. Malathi., A Detailed Analysis on NSL-KDD Dataset Using Various Machine Learning Techniques for
Intrusion Detection, International Journal of Engineering & Technology, Vol. 2.
[6] KDDCup dataset (1999). http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html.
[7] Matlab Language of Technical Computing (2014). http://in.mathworks.com/products/matlab/.
[8] Weka 3.6.9: Data Mining Software, http://www.cs.waikato.ac.nz/ml/weka/.

All rights reserved by www.grdjournals.com

301