An ECOSVS-based support vector machine for network anomaly detection

In this paper, the support vector machine (SVM) classification technique to classify normal and attack traffic in the Spark distributed environment has been introduced and evaluated. In terms of classification speed, SVM suffers from the important shortcomings of high time and memory training complexities, which depend on the training set size. The authors have proposed an effective correlation-based support vector selection (ECOSVS) algorithm for SVM speed optimisation. ECOSVS-based SVM performed better when compared with the other three supervised classifiers, namely, logistic regression (LR), decision tree (DT), and random forest (RF) in terms of accuracy and training time. Apache Spark's RDD structure has been used for the detection of network-based anomalies. The analysis of the said algorithm was performed on two publicly available network datasets, namely, Network Security Laboratory-Knowledge Discovery in Databases (NSL-KDD) dataset and Coburg Intrusion Detection Datasets (CIDDS-2017). The results showed that our proposed algorithm reduced the training set size of NSL-KDD and CIDDS-2017 datasets to 99.3% and 85%, respectively. Accuracies of 80% and 87% for the ECOSVS-based SVM classifier were achieved.