A Hybrid Model of RST and DST with its Application in Intrusion Detection

Intrusion Detection system has become the main research focus in the area of information security. Dempster-Shafer theory of Evidence (DST) and rough set theory (RST) are two typically effective tools in dealing with uncertainty questions including network intrusion detection. In this paper, to solve some problems in applying DST, a hybrid approach of RST and DST is proposed. Firstly, to obtain basic probability assignment (BPA) of evidence theory for all evidences, a novel method of getting evidences and objective BPA based on attribute importance is presented. The attribute simplification algorithm is established to eliminate redundant evidences and establish the final combined evidences. A hybrid model for intrusion detection based on RST and DST is presented to give a higher detection precision and better performance, and in an illustrative example it is effective and feasible.