Hierarchical Core Vector Machines for Network Intrusion Detection

For labelling network intrusions as they state hierarchical multi-label structure, we develop a hierarchical core vector machines (HCVM) algorithm for high-speed network intrusion detection via hierarchical multi-label classification of network data. HCVM models a multi-label hierarchy into a data Hyper-Sphere constructed by numbers of core vector machines (CVM). As the CVMs in an HCVM are separating, encompassing and overlapping with each other, which forms naturally a tree structure representing the multi-label hierarchy encoded. Provided an unlabelled sample, the HCVM seeks a CVM enclosing the sample, and multiply label the sample according to the MEB's position in the hierarchy. The proposed HCVM method has been examined on KDD'99 and the result shows that the proposed HCVM has significant improvement over previously published benchmark works. HCVM improves U2R accuracy from 13.2% to 82.7% and R2L from 8.4% to 45.9%, as compared to the winner of KDD'99. In particular, the efficiency of HCVM is highlighted, as the computational time stays steady while the size of training data exponentially manifolds.