Intrusion Detection using Sequential Hybrid Model
This work addresses intrusion detection for network security, but it appears incremental as it builds on existing hybrid approaches with a sequential modification.
The paper tackled network intrusion detection by proposing a sequential hybrid model that combines two anomaly detection models followed by misuse detection to verify anomalies and reduce false positives, achieving a very high degree of accuracy.
A large amount of work has been done on the KDD 99 dataset, most of which includes the use of a hybrid anomaly and misuse detection model done in parallel with each other. In order to further classify the intrusions, our approach to network intrusion detection includes use of two different anomaly detection models followed by misuse detection applied on the combined output obtained from the previous step. The end goal of this is to verify the anomalies detected by the anomaly detection algorithm and clarify whether they are actually intrusions or random outliers from the trained normal (and thus to try and reduce the number of false positives). We aim to detect a pattern in this novel intrusion technique itself, and not the handling of such intrusions. The intrusions were detected to a very high degree of accuracy.