An intrusion detection method based on LLE and BVM

The popularity of using Internet brings some risks of network attacks. The technology of intrusion detection is an important component of network security. The traditional Intrusion Detection System (IDS) generally has the following disadvantages: the first one is that it could not detect the new type attacks even the variation of existed attacks; the second one is the detection time is so long that the real-time capability of the system is low. In this paper we proposed a new model based on LLE and BVM to solve the problems mentioned above. This model is different from traditional IDS, we use BVM classifier to differentiate the normal and abnormal attacks, and we added a pre-process module before the classifier. In the pre-process module, we use LLE to extract the main features of the intrusion data, which is the main part of the pre-process module, and then the principal components of the data are used as input of BVM classifier that differentiates the normal and abnormal actions. Applying this proposed system to KDDCUP99 data, experimental results clearly illustrates that this model has a remarkable performance in detecting both existed instruction and new ones.