TELKOM
NIKA
, Vol.12, No
.4, Dece
mbe
r
2014, pp. 10
88~109
5
ISSN: 1693-6
930,
accredited
A
by DIKTI, De
cree No: 58/DIK
T
I/Kep/2013
DOI
:
10.12928/TELKOMNIKA.v12i4.889
1088
Re
cei
v
ed Se
ptem
ber 3, 2014; Re
vi
sed
No
vem
ber 5,
2014; Accept
ed No
vem
b
e
r
20, 2014
A Novel Intrusion Detection Approach using Multi-
Kernel Functions
Li Jiao Pan*, Weijian Jin, Jin Wu
Schoo
l of Elect
r
o-Mech
anic
a
l
& Information
T
e
chnolog
y, Yi
w
u
I
ndustri
a
l &
Commercia
l C
o
lle
ge
No. 2 Xue
y
u
a
n
Road, Yi
w
u
32
200
0, Chi
na, telp/fa
x 057
9-8
3
803
61
2
*Corres
p
o
ndi
n
g
author, e-ma
i
l
: panl
iji
ao_
y
w
u
@
16
3.com
A
b
st
r
a
ct
Netw
ork intrusi
on d
e
tectio
n fi
nds var
i
ant a
p
p
licati
ons
in co
mp
uter a
nd
ne
tw
ork industry. How
to
achi
eve h
i
gh
i
n
trusio
n detect
i
on acc
u
racy a
nd spe
ed is st
i
ll rece
ived c
o
n
s
ider
abl
e atten
t
ions in th
is fie
l
d.
T
o
ad
dress t
h
is iss
ue, th
is
w
o
rk pres
ent
s a n
o
ve
l
method
that ta
kes a
d
v
anta
g
es of
multi-ke
rnel
computati
on te
chni
que
to re
al
i
z
e
sp
ee
dy a
n
d
precis
e n
e
tw
ork intrusi
on
det
ection
an
d is
ol
ation. In
this
n
e
w
deve
l
op
ment the multi-ker
n
e
l
f
unction bas
e
d
kernel d
i
rect
discri
m
in
ant a
nalysis (MKD
D
A
) and qu
antu
m
particl
e sw
arm opti
m
i
z
a
t
io
n (QPSO) o
p
timi
z
e
d ke
r
n
el extre
m
e l
earn
i
ng
mac
h
ine (KELM)
w
e
re
appr
opri
a
tely i
n
tegrate
d
an
d thus form a n
o
v
el meth
o
d
w
i
th strong intrus
i
on
detecti
on a
b
ility. The MK
DDA
here
i
n w
a
s firs
tly e
m
pl
oye
d
t
o
extract
distin
ct features
by
proj
ecting
the
origi
n
a
l
h
i
gh
di
me
nsi
ona
lity of
th
e
intrusi
on fe
atur
es int
o
a
low
d
i
mensi
o
n
a
lity s
pace. A
f
e
w
di
stinct an
d effici
ent featur
es w
e
re th
en s
e
lect
e
d
out fro
m
the l
o
w
dime
nsi
ona
li
ty space. Sec
o
ndly,
the K
E
L
M
w
a
s propos
ed to pr
ovi
de
quick
and
accu
rate
intrusi
on r
e
cog
n
itio
n o
n
the
e
x
tracted featur
es. T
he o
n
ly
p
a
ra
meter
ne
ed
be
deter
mi
ne
d in
KELM
is t
h
e
neur
on
nu
mb
e
r
of hid
d
e
n
la
yer. Literatur
e
review
in
dicat
e
s that very
li
mite
d w
o
rk ha
s addr
esse
d th
e
opti
m
i
z
at
ion of
this para
m
et
er. Hence, the
QPSO
was
used for the first tim
e
to optim
i
z
e
the KELM
para
m
eter in
this p
a
p
e
r. Las
tly, experi
m
ent
s have
be
en
i
m
p
l
e
m
e
n
ted
to
verify the
per
forma
n
ce
of th
e
prop
osed
method. T
he test
result
s in
dicat
e
that the pro
pose
d
LLE-PS
O
-KELM meth
od out
perfor
m
s its
rivals in ter
m
s
of both reco
gni
tion accur
a
cy a
nd spe
ed. T
h
u
s
, the propos
e
d
intrusi
on d
e
tection
meth
od
has
great practic
a
l i
m
p
o
rtanc
e.
Ke
y
w
ords
: ne
tw
ork intrusion
detectio
n
,
mu
lti-kerne
l
functi
on b
a
se
d ker
n
el d
i
rect discr
i
m
i
n
a
n
t an
alysi
s,
kerne
l
extre
m
e
learn
i
ng
mac
h
i
ne, qua
ntu
m
p
a
rticle sw
arm
o
p
timi
z
a
ti
on
1. Introduc
tion
Along with
th
e
ra
pid devel
opment of
int
e
rnet
and
the
asso
ciate
d
a
pplication
net
works,
netwo
rk secu
rity has be
come a
promi
nent an
d
tou
gh p
r
obl
em,
in pa
rticul
ar,
intru
s
ion
s
a
n
d
attacks on
compute
r
net
work
system
s be
com
e
s
more
com
p
le
x and diverse. Huge
eco
nomic
losse
s
h
a
ve
been
cau
s
ed
by the
co
m
puter and
ne
twork int
r
u
s
io
ns
and
attacks eve
r
y yea
r
.
Therefore, it
is e
s
sential t
o
dete
c
t the
intrus
i
o
n
s
a
n
d
attacks in
time to prevent dam
age
s of
comp
uters an
d netwo
rks.
The dive
rsity
and the
evolu
t
ion of the int
r
usi
on
viruse
s ma
ke it very difficult in d
e
tecting
and
i
dentifyin
g
the und
erg
o
ing network intrusi
on.
F
r
o
m
the
early
worm vi
ru
s to t
he
re
cent
sh
o
ck,
sho
c
k waves and the
pan
da in
cen
s
e vi
ruses, th
e attacking
obje
c
t
s
almo
st in
cl
ude all
com
p
uter
system
accessed to the intern
et. The attacking
viruses
will
cost the
system
resources,
manipul
ate d
a
ta and
ste
a
l
the confide
n
t
ial info
rmatio
n, leadin
g
to
massive
economi
c
lo
sse
s
.
Typical
intru
s
ion viru
se
s in
cludi
ng th
e
Denial
of Se
rvi
c
e (DoS), Re
mote
to Lo
cal
(R2L
), Use
r
to
Root (U2
R
),
and Pro
be o
r
Scan
(PoS
). Besi
de, A
m
eri
c
an b
u
si
ness ma
ga
zi
ne "Informati
on
Wee
k
ly" ha
s publi
s
hed
a
survey o
n
the netwo
rk in
trusi
on a
nd in
dicate
s that
a netwo
rk attack
happ
en
s every seco
nd in t
he glob
al sco
pe. In su
ch
a
situation, net
work
se
curity
has be
co
me
an
urge
nt a
nd
p
r
acti
cal
probl
em a
nd
re
cei
v
ed worl
dwid
e attention
s
.
Ho
w to
devel
op a
n
d
u
s
e t
h
e
existing
se
cu
rity techn
o
log
y
to prot
ect
a
ll kin
d
s
of resource
s from
damag
e i
s
th
e hot
sp
ot in
the
resea
r
ch field of network
se
curity. Effective in
trusi
o
n detection t
e
ch
nolo
g
y is the key issue
to
solve this problem.
The ma
chi
n
e
learni
ng i
s
a
very useful tech
nol
o
g
y in
the field of compute
r
an
d
netwo
rk
se
curity. Ho
wever, th
e n
e
twork i
n
tru
s
i
ons
are
al
wa
ys contamin
a
t
ed by ba
ckg
r
oun
d n
o
ise. In
addition, the
high dime
nsi
onality of the intrusio
n
dat
a increa
se
s their dete
c
tio
n
difficulties [
1
].
Hen
c
e, it i
s
cru
c
ial
to
eli
m
inate
usel
e
s
s info
rmatio
n an
d extract distin
ct fea
t
ures in
a l
o
w
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
A Novel Intru
s
ion
Dete
ctio
n Appro
a
ch u
s
ing Multi Kernel Fun
c
tion
s (Li Jiao Pa
n)
1089
dimen
s
ion
a
l spa
c
e.
By do
ing so, the computat
ion
cost and the detectio
n
performan
ce ca
n be
simultan
eou
sl
y optimize
d
. Although t
he p
r
in
cipal
com
pon
ent
analysi
s
(P
CA) [2] a
n
d
its
derivative al
gorithm
s h
a
ve bee
n proven to be
po
werful fo
r fe
ature extracti
on in the lo
w
dimen
s
ion
a
l
spa
c
e, th
e li
mitation is th
at the PCA
can
not extra
c
t no
nlinea
r
prop
ertie
s
of
the
original data [
3
]. In c
o
ntras
t
to PCA, the
KDDA
ca
n ex
tract
nonlin
ea
r p
r
op
ertie
s
from the
ori
g
in
al
data [4]. The
KDDA a
dop
t the ke
rnel t
r
ick to r
edu
ce the hig
h
di
mensi
onal i
m
age d
a
ta into
a
much
lo
wer d
i
mensi
on
sp
a
c
e by
ke
epin
g
the n
onli
n
e
a
r p
r
op
ertie
s
of the o
r
iginal
data. By doi
ng
so, the
n
onli
near p
r
op
erti
es
of the
dat
a of i
n
te
re
st
can
be
obtai
ned. T
he
co
nstru
c
tion
of
the
kernel fu
ncti
on g
r
eatly d
e
termin
es th
e pe
rform
a
n
c
e of KDDA i
n
feature ext
r
actio
n
. In m
o
st
existing
ke
rn
el fun
c
tion
s
of KDDA, sin
g
le
kernel
w
a
s
us
ed; h
o
wev
e
r,
re
ce
n
t
re
sea
r
c
h
re
sult
s
h
ow
n gr
e
a
t
in
te
r
e
s
t
in multi-
k
e
rnel.
Mul
t
iply ke
rnel
s
woul
d h
a
ve
more
excelle
nt ch
aracte
ristics
than
singl
e
kernel
an
d thu
s
p
r
ovide
b
e
tter
perfo
rma
n
c
e
of KDDA.
Literatu
re
revi
ew i
ndi
cate
s t
hat
the limited
work ha
s b
e
e
n
don
e to a
d
d
re
ss the m
u
lti-ke
rn
el issue for K
D
DA in the int
r
u
s
ion
detectio
n
[5]. He
nce, the
outcom
e
s of
the mult
i-ke
rnel fun
c
tion
based K
DDA
(MK
DDA
)
sh
ould
be evaluate
d
.
On the other hand, the artificial intelligenc
e has been extensivel
y used in the network
intrusi
on d
e
te
ction, such a
s
artifici
al ne
ural
n
e
two
r
k
(ANN) a
nd
suppo
rt vector machi
ne (S
VM)
[6-9]. Ho
wev
e
r, the ANNs,
includi
ng BP NN a
nd
RBF NN, a
r
e often
suffer fro
m
lo
cal minim
a
a
nd
slo
w
co
nverg
ence sp
eed [
6
]; and the SVM need
s to
determi
ne th
e ke
rnel fun
c
t
i
on, error
con
t
rol
para
m
eters,
and p
enalty coefficient. He
nce, al
th
oug
h
ANN
and SV
M have a
lot
of advantag
e
s
in
machi
ne l
earning [10], they face
chall
e
nges on
learning
speed and scal
ability, whi
c
h limit t
heir
appli
c
ation
s
i
n
network in
trusio
n dete
c
tion. In
orde
r to overco
me this p
r
o
b
l
em, the ke
rnel
extreme lea
r
ning ma
chin
e
(KELM) ha
s been propo
sed as en inte
gration of ANN and SVM to
provide
qui
ck and a
c
curate pattern
re
cogniti
on a
b
ility [11]. The KELM ha
s the
advantage
s
of
both ANN an
d SVM while
only need
s to
set up on
e
o
n
ly param
ete
r
, i.e. the number of hid
d
en
layer no
de
s
of the netwo
rk [11]. Zong
and
Huan
g
[11] have p
r
e
s
ente
d
the K
E
LM in the face
recognitio
n
a
nd foun
d th
at the KEL
M outpe
rfor
ms LS
-SVM
in term
s of
both recog
n
ition
predi
ction a
c
curacy an
d training
spee
d. Howeve
r, a para
m
eter o
p
t
imization me
cha
n
ism of the
KELM has
n
o
t well devel
oped in
exist
i
ng work. Proper
setting
of the neu
ro
n numb
e
r of
the
KELM can e
nhan
ce the t
r
ainin
g
sp
ee
d and a
c
curacy [12, 13]. It is therefore impe
rative
to
develop a
n
o
p
timization m
e
ch
ani
sm for
the KELM.
To e
nhan
ce
t
he n
e
two
r
k in
trusio
n
detect
i
on,
this work presents a
n
e
w
method
b
a
se
d o
n
the MKDDA
and QPSO-K
ELM. Compa
r
ed with PC
A
,
the propo
se
d method ha
s employe
d
the
MKDDA to
extract n
onlin
ea
r feat
ures of the face ima
g
e
s. It also de
veloped th
e o
p
timized
KEL
M
for faster a
nd more preci
s
e intru
s
i
on dete
c
tion
when
com
parin
g with
ANN an
d SVM.
Experimental analysi
s
ha
s verified
high
perfo
rman
ce
of the propo
sed method.
2. Rese
arch
Metho
d
In this work,
the intrusi
on
detectio
n
m
e
thod b
a
sed
o
n
the
MKDDA and
QPSO
-KELM
has b
een p
r
o
posed. A brie
f description
about the
pro
posed metho
d
is illustrated
as follows.
2.1. MKDDA
Assum
e
12
[]
p
m
R
Xx
x
x
and its
sub
s
et
i
X
X
with
q
eleme
n
ts.
Let
()
:
N
x
xR
F
a nonli
nea
r m
appin
g
from i
nput spa
c
e to
a high
dimen
s
ion
a
l feature
spa
c
e
F
, in which
the inn
e
r-cl
ass an
d in
te
r-cl
ass scatter matrices
are
w
S
and
b
S
. Then
we define
w
S
and
b
S
as
follows:
1
T
()
(
)
1
m
q
ii
i
b
p
i
S
,
(1)
1
T
()
(
)
1
1
m
q
ij
i
i
j
i
w
p
i
j
S
,
(2)
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 12, No. 4, Dece
mb
er 201
4: 108
8 – 1095
1090
Whe
r
e,
()
x
ij
i
j
;
1
()
1
q
x
ij
i
q
j
den
o
t
es the
samp
le mean
of cl
ass
i
X
;
1
()
1
1
p
q
x
ij
p
i
j
denote
s
the a
v
erage of the
sampl
e
. Then
we co
uld obt
ain
T
TT
(
(
))(
(
)
)
=
11
bb
mm
qq
ii
ii
i
i
b
pp
ii
S
,
(3)
Whe
r
e,
()
q
i
ii
p
and
1
[
...
]
bm
.
Form (3) we
can see that the dot produ
ct is
requi
re
d to calcul
ate
T
bb
. The dot pro
d
u
c
t is very comp
utati
onal cost a
nd in order to
avoid it
the kernel fun
c
tion ha
s be
e
n
prop
osed to
compute
T
bb
[4].
In this work, we propo
se
d a multi-ke
rn
el
functi
on that integrate
d
the
radial ba
sis f
unctio
n
(RBF
) kernel
and p
o
lyno
mial ke
rn
el
function
s
to
provide
mo
re effici
ent
kernel fun
c
ti
on
comp
utation [4]. The multi-kernel fun
c
tio
n
is de
scribe
d as
2
2
(,
)
e
x
p
(
)
(
1
)
(
)
2
xy
Kx
y
x
y
b
,
(4)
Whe
r
e,
,
xy
are t
he inp
u
ts,
,
and
b
are
co
nst
ants. Th
en, t
he
T
bb
can be ca
lculate
d
by
the ke
rnel fu
nction
rathe
r
than the d
o
t prod
uctio
n
.
Thus, the
origin
al data
s
et
X
co
uld
be
proje
c
ted into
low dimentio
nal feature
sp
ace
F
by solve the eigenva
l
ue pro
b
lem [
4
].
2.2. QPSO-KELM
Given sam
p
l
e
s
{
(
,
)
:
1
,
2
,
.
..,
;
,
}
pq
ii
i
i
y
gi
N
y
R
g
R
, w
h
er
e
y
i
s
the
featu
r
e
vector an
d
g
is the cla
s
s label vecto
r
, the belo
w
fun
c
tion is u
s
e
d
to identify the sampl
e
[10]
s
(
)
,
=1,
2,
...
,
.
1
T
ii
j
i
i
n
y
bo
j
N
i
(5)
Whe
r
e,
s(
)
is the activation function;
n
is th
e numbe
r of hidde
n neu
ro
n;
i
o
is the outpu
t of
j
th
sampl
e
;
i
and
i
are the input a
nd output wei
ght vectors;
i
b
is the thre
shol
d of the
i
th hidden
neuron. If the output
o
can a
pproxim
ate
g
, then
1
s
(
)
,
=1,
2 ,.
..,
N.
n
T
ij
i
j
j
i
yb
o
=
t
j
i
(6)
Hen
c
e, we de
rive
H
ξ
=T
,
(7)
Whe
r
e,
11
1
1
11
s(
)
s
(
)
s(
)
s
(
)
TT
nn
TT
Nn
N
n
yb
yb
yb
yb
,
11
[,
,
]
a
n
d
[
,
,
]
TT
nN
gg
ξ
G
.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
A Novel Intru
s
ion
Dete
ctio
n Appro
a
ch u
s
ing Multi Kernel Fun
c
tion
s (Li Jiao Pa
n)
1091
To solve (7), the KELM ado
pts a lea
s
t sq
uare
s
e
rro
r to
get solution:
†
ξ
HT
,
(8)
whe
r
e,
†
H
is the
Moore-Pe
nro
s
e ge
neralize
d
inverse of
H
. Func
tion
s(
)
is usually unknown, we
repla
c
e it by the ke
rnel m
a
trix
1
K(
;
)
K(
;
)
T
N
xx
xx
K
(
K(
)
is the kernel functio
n
). Then it
yields
oK
T
(9)
Herein, the G
aussia
n
kern
el functio
n
(R
BF) is a
dopte
d
. The nu
mb
er of hid
den
neuron
n
is difficult to determin
e
. He
nce,
QPSO was u
s
ed to ob
tain a prop
er
n
[11].
2.3. The Proposed Intr
us
ion Detectio
n Method
In this pap
er
the novel dev
elopme
n
t usi
ng MKDDA-QPSO-KELM
are p
r
op
ose
d
for the
netwo
rk int
r
u
s
ion d
e
tectio
n. The pro
p
o
s
ed n
e
tw
o
r
k i
n
trusi
on dete
c
tion processes are given
as
follows
:
Step 1: Pre-treat the origin
al netwo
rk in
t
r
usi
on data to
standa
rdi
z
ed
data format.
Step 2: Extract di
stin
ct f
eature
s
from
the
i
nput
ne
twork i
n
tru
s
io
n data
in
the
form
of
manifold by MKDDA.
Step 3: Train
the KELM using the n
e
w feat
ure
s
, an
d determi
ne the neu
ron
nu
mber of
hidde
n layer
of KELM usin
g QPSO.
Step 4: Test the perfo
rma
n
ce of the p
r
opo
sed n
e
twork int
r
u
s
ion
detectio
n
mo
del, and
provide
the
test
re
sult a
s
the
base fo
r a
va
lid
net
work intru
s
io
n ma
nage
me
nt de
cisi
on.
A
diagram block of the proposed network i
n
trusi
on detection method is illustrated i
n
Figure 1.
Figure 1. The
propo
se
d net
work intrusi
o
n detectio
n
method
3. Results a
nd Analy
s
is
In orde
r to
evaluate the
perfo
rman
ce of
the p
r
o
posed
comp
uter intrusi
o
n
method,
experim
ent tests have
be
en impl
ement
ed in thi
s
wo
rk. Fi
g. 2
sho
w
s the exp
e
ri
ment set-u
p
. A
mini net
wo
rk wa
s
esta
blished
by u
s
ing
one
linux
se
rver
and
on
e
win
d
o
w
s server, a
s
well
as
three
windo
ws ho
sts a
nd three lin
ux ho
sts. The
D
eni
al of Service (DoS),
Remot
e
to Local (R2L),
User to
Root
(U2
R
) an
d Probe o
r
Scan
(PoS)
were
si
mulated u
s
in
g this exp
e
ri
ment set
-
up.
We
have
colle
cte
d
3,000
sam
p
les for
ea
ch
intru
s
ion
type and
35
feat
ure
s
fo
r ea
ch
sam
p
le. Th
e
s
e
feature
s
in
cl
ude the
byte
s i
s
sued f
r
o
m
so
urce to
de
stination,
the bytes from de
stinati
on to
sou
r
ce, du
rat
i
on, teard
r
op,
neptun
e, etc. Here
i
n
5, 0
00 sample
s
of each intru
s
ion type h
a
v
e
been
re
co
rde
d
for th
e exp
e
rime
ntal test
. Figs. 3
~
5
show t
he feat
ure
sel
e
ctio
n
re
sults by th
ree
popul
ar meth
ods, i.e. Kern
el PCA (KPCA), KDDA an
d MKDDA.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 12, No. 4, Dece
mb
er 201
4: 108
8 – 1095
1092
Figure 2. The
experime
n
t set-up
Figure 3. Fea
t
ure extra
c
tio
n
result usin
g
KPCA
-2
0
2
4
6
8
10
12
14
16
-2
0
2
4
6
8
10
12
14
T
h
e fi
r
s
t new
fea
t
u
r
e
The
s
e
c
o
nd n
e
w
f
e
a
t
ur
e
Do
S
R2
L
U2
R
Po
S
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
A Novel Intru
s
ion
Dete
ctio
n Appro
a
ch u
s
ing Multi Kernel Fun
c
tion
s (Li Jiao Pa
n)
1093
Figure 4. Fea
t
ure extra
c
tio
n
result usin
g
KDDA
Figure 5. Fea
t
ure extra
c
tio
n
result usin
g
MKDDA
It c
an be
s
e
en in Figure 3
that when us
ing KPAC
to selec
t
the most us
eful features
jus
t
the intru
s
io
n
type of DoS
coul
d be
ide
n
tified we
ll
while the
other three
types
were ove
r
lap
p
e
d
with ea
ch oth
e
r. This m
e
a
n
s the featu
r
e sele
ction
rate of the KPCA is
very low in this
s
t
udy. In
Fig. 4
we
co
uld note
that
the KD
DA
can
sepa
rate t
w
o type
s of i
n
trusi
o
n
s
, i.e. R2L
an
d
U2
R;
however, the
DoS and P
o
S were co
mpletely mi
xed up. In co
ntrast, wh
en
the MKDDA
wa
s
adopte
d
in Fi
g. 5 it indicat
ed that the fo
ur types
of intrusi
o
n
s
ha
d b
een
well reco
gnized by cl
e
a
r
boun
dari
e
s th
ough
a
small
portion
of the
intru
s
ion
s
d
a
t
a mixed toge
ther. As
a result, the feature
sele
ction p
e
rf
orma
nce of the MKDDA wa
s su
peri
o
r tha
n
that of KPCA and KDDA.
Table
1 li
st
s the
comp
arison
of th
e p
r
opo
se
d
metho
d
a
g
a
inst
so
me
existing
approa
che
s
.
-10
-8
-6
-4
-2
0
2
4
6
8
10
-10
-5
0
5
10
15
T
h
e fi
r
s
t n
e
w
f
eat
u
r
e
The
s
e
c
ond
ne
w
fe
a
t
ur
e
DoS
R2L
U2R
PoS
-6
-4
-2
0
2
4
6
8
10
12
-1
5
-1
0
-5
0
5
10
15
20
T
h
e
fi
r
s
t
ne
w
fe
a
t
ur
e
The
s
e
c
ond
n
e
w
fe
a
t
ur
e
DoS
R2
L
U2
R
PoS
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 12, No. 4, Dece
mb
er 201
4: 108
8 – 1095
1094
Table 1. The
comp
ari
s
o
n
result
s of the face recogniti
on
Me
t
h
od
Detec
t
ion
r
a
t
e
(%
)
Com
p
u
t
ati
on
time (s)
Me
t
h
od
Detec
t
ion
r
a
t
e
(%
)
Com
p
u
t
ati
on
time (s)
PCA-SVM 77.7
5.3
KPCA-SVM
78.7
5.3
PCA-ANN
75.3
5.4
KPCA-ANN
75.7
5.5
PCA-KELM
77.7
4.9
KPCA-KELM
79.3
5.0
PCA-QPS
O
-KEL
M 78.7
4.5
KPCA-QPS
O
-KE
L
M
79.7
4.5
KDDA-SVM
83.3
5.2
MKDDA-SVM
83.7
5.2
KDDA-ANN
83.3
5.2
MKDDA-ANN
83.7
5.3
KDDA-KELM
83.7
4.9
MKDDA-KELM
84.3
4.9
KDDA-
Q
PSO-KE
L
M 84.3
4.5
MKDDA-
Q
PSO-
KELM
85.3
4.4
In Table 1 it can be se
en that the MKDDA
-QPS
O-KELM out
perfo
rmed th
e other
method
s an
d obtaine
d the
best intrusi
o
n
detection
ra
t
e
. The be
st d
e
tection
rate i
s
85.3%, whi
c
h
is 1.0% hig
h
e
r o
r
mo
re th
an the SVM
and ANN b
a
sed ap
pro
c
h
e
d
. This i
s
be
cau
s
e KELM
has
advantag
es
of both SVM and ANN a
nd in the sa
me time KELM only use
s
one pa
ram
e
ter to
lighten it
s
structure to
obt
ain b
e
tter l
e
a
r
ning
ability t
han SVM
an
d ANN [7]. O
ne al
so
can
note
that the int
r
u
s
ion
dete
c
tio
n
rate of MK
DDA
-QPSO
-KELM is 1.0
%
highe
r th
a
n
MKDDA-K
E
LM.
This m
ean
s
that the QP
SO ha
s cont
ributed
so
me
efford to e
n
han
ce the K
E
LM re
co
gnition
perfo
rman
ce.
By applying
QPSO to KELM, its ne
uro
n
num
ber co
uld be
optimi
z
ed to
yield f
a
ter
and high
er re
cog
n
ition rate
. This explain
s
why the propo
sed meth
od gene
rate
d
better intru
s
i
on
detectio
n
rat
e
than the others.
Hen
c
e,
the comp
ari
s
on re
sults in
dicate that the KELM has fast
training
sp
ee
d owning to i
t
s sp
eci
a
l st
ructur
e, and
the MKDDA-QPSO-KELM
can i
m
prove
the
intrusi
on dete
c
tion rate.
4. Conclusio
n
In orde
r to d
e
velop a
n
efficient meth
od
for intru
s
io
n
detectio
n
, a
new m
e
thod
based o
n
MKDDA
and
QPSO-KEL
M ha
s
bee
n
presented
to
em
han
ce
the dete
c
tion
accu
ra
cy a
n
d
comp
utation
spe
ed in thi
s
work. Th
e i
novation of
t
he propo
se
d
work i
s
that
the multi-ke
rnel
function
ba
se
d KDDA was pro
p
o
s
ed to
give bette
r feature
sele
ction pe
rforma
ce than
a
sing
le
kernel
fun
c
tio
n
of K
DDA.
Mean
while,
the QPS
O
wa
s e
m
ploye
d
t
o
midify the
only pa
ram
e
ter
of
the KELM an
d hen
ce
re
asonabl
e KELM
stru
cture
co
uld be
obtain
ed to en
han
ce the intrusi
o
n
detectio
n
rat
e
. Experim
en
tal test
s h
a
ve be
en
carrie
d out
to ve
rify the p
r
op
osed m
e
thod.
The
analysi
s
re
sul
t
s dem
on
strat
e
that g
ood
in
trusio
n
d
e
tect
ion p
e
rfo
r
ma
nce
could
be
attained
by th
e
prop
osed m
e
thod. In a
ddition, thro
ugh
com
par
i
s
on
betwee
n
differe
nt feature
extra
c
tion
algorith
m
s (i.
e
. PCA, KPCA, KDDA and
MKDDA) a
n
d
different int
e
lligent sepa
rators
(i.e. SVM,
ANN
and
KELM) th
e p
r
op
ose
d
MK
DDA
-QPSO-KEL
M metho
d
ge
nerate
d
the
b
e
st p
e
rfo
r
ma
nce
in term
s
of accu
ra
cy a
nd
comp
utation
co
st. Th
us, the
p
r
op
ose
d
meth
o
d
ha
s
pra
c
ti
cal
importa
nce. Future research will focu
s o
n
the
indu
stri
al pra
c
tice of
the prop
osed
method.
Referen
ces
[1]
Z
hu S, H
u
B.
H
y
brid
featur
e
se
lecti
o
n
bas
ed
on
improv
e
d
GA for th
e i
n
trusio
n d
e
tect
ion s
y
st
em.
TEL
K
OMNIKA
. 2012; 1
1
(4): 1
725
–1
730.
[2]
Hou
G,
Ma X,
Z
han
g
Y.
A
ne
w
metho
d
f
o
r
i
n
trusio
n de
tection usin
g manifo
ld le
arni
ng alg
o
rithm.
T
E
LKOMNIKA Indon
esi
an Jou
r
nal of Electric
al Eng
i
ne
eri
n
g
.
2013; 1
1
(12):
734
4–
735
0.
[3]
Z
hu S, Hu B. H
y
brid F
e
ature
Selectio
n Bas
ed on
Impr
ove
d
GA for the Intrusio
n Detec
t
ion S
y
stem.
T
E
LKOMNIKA Indon
esi
an Jou
r
nal of Electric
al Eng
i
ne
eri
n
g
.
2013; 1
1
(4): 1
725
–1
730.
[4]
Li F
,
T
ang W
,
Du
an
H, H
a
o
J. App
lic
ation
of fractio
n
a
l
p
o
w
e
r
po
l
y
n
o
mi
al k
e
rne
l
fu
ncti
on to
ker
nel
direct discrim
in
ant ana
l
y
sis.
Optics and Prec
i
s
ion En
gin
eer
i
n
g
. 200
7; 15(9)
: 1140-1
1
4
4
.
[5]
Li F
,
Xu K. Kernel mod
e
l a
ppl
i
ed in kern
el dir
e
ct
discrimin
an
t anal
ysis for the reco
gniti
on
of face
w
i
th
non
lin
ear vari
a
t
ions.
T
r
ansacti
ons of T
i
anj
in
Univers
i
ty
. 200
6; 12(2): 14
7-1
52.
[6]
Lia
ng L.
Net
w
o
r
k intr
usio
n
detectio
n
s
ystem base
d
on o
p
timize
d
F
u
zz
y
ru
les
alg
o
rithm.
T
E
LKOMNIKA Indon
esi
an Jou
r
nal of Electric
al Eng
i
ne
eri
n
g
.
2014; 1
2
(4): 2
816
–2
825.
[7]
Che
n
S, Diao
H. A net
w
o
rk i
n
trusio
n detect
i
on meth
od b
a
s
ed on im
prov
ed ACBM.
TELKOMNIKA
Indon
esi
an Jou
r
nal of Electric
al Eng
i
ne
eri
n
g
.
2014; 1
2
(4): 2
808
–2
815.
[8]
Liu
L, W
an P,
W
ang Y, Li
u
S. Clusteri
ng
and
h
y
br
i
d
g
e
netic a
l
gor
ithm
base
d
i
n
trusi
on d
e
tectio
n
strategy
.
T
E
LK
OMNIKA Indon
esia
n Journ
a
l o
f
Electrical Eng
i
ne
erin
g
. 201
4; 12(1): 762
–7
7
0
.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
A Novel Intru
s
ion
Dete
ctio
n Appro
a
ch u
s
ing Multi Kernel Fun
c
tion
s (Li Jiao Pa
n)
1095
[9]
Yu G, W
eng K. Intrusion d
e
te
ction s
y
stem a
nd te
ch
nol
og
y
of la
yere
d
w
i
r
e
l
e
ss sensor
net
w
o
rk bas
ed
on Age
n
t.
T
E
LKOMNIKA Indones
ian J
ourn
a
l of Electrica
l
Engi
neer
in
g
. 2013; 11(
8): 423
8–4
34
3.
[10]
Hua
ng G,
Ch
en
L. En
ha
nc
ed r
a
n
dom s
earch
b
a
sed
increme
n
tal
e
x
treme
l
earn
i
n
g
mac
h
in
e.
N
e
u
r
o
c
om
pu
ti
ng
.
2008; 7
1
: 16
–18.
[11]
Z
ong W
,
Hu
an
g G, Lin Z
.
F
a
ce reco
gniti
on
base
d
o
n
e
x
tr
eme l
earn
i
n
g
machi
ne.
Ne
ur
oco
m
p
u
ting
.
201
1; 74: 254
1
–25
51.
[12]
Jian
g Y, W
u
J
,
Z
ong
C. An
effective d
i
a
g
n
o
sis m
e
t
hod
fo
r sin
g
le
an
d m
u
ltipl
e
defects
detectio
n
i
n
gear
bo
x bas
ed
on non
lin
ear feature se
lectio
n
and ker
nel-
b
ased e
x
trem
e l
earn
i
ng mac
h
i
ne.
Jo
u
r
na
l
of
Vibro
eng
in
eeri
n
g
. 201
4; 16(1)
: 499–5
12.
[13]
Sun H, Qi Y. A chaos cloud p
a
rticle
s
w
a
rm
alg
o
rit
h
m base
d
av
aila
bl
e transfe
r capabi
lit
y
.
T
E
LKOMNIKA Indon
esi
an Jou
r
nal of Electric
al Eng
i
ne
eri
n
g
.
2014; 1
2
(1): 3
8–4
7.
Evaluation Warning : The document was created with Spire.PDF for Python.