Network Intrusion Detection using a Hybrid of Hidden Markov Model and Extreme Learning Machine

With the growth of information technology, network security is raised as one of the most important issues and challenges. Anomaly-based intrusion detection system is a valuable technology for network protection against malicious activities. In this paper a new approach is proposed based on hidden Markov model (HMM) and extreme learning machine (ELM) for intrusion detection. In the proposed model, the data that have been collected from network traffic are preprocessed at first. Then, the sequence of observations, are fed into HMM and the model is trained using Baum-Welch algorithm. In the recognition phase, Viterbi algorithm is used and the optimal state sequences are extracted from the input observations. Then, the sequence of states is considered as the input of ELM network and classified to normal or attack classes. Darpa98 dataset which is network trafic data is used to evaluate the approach. We evaluated the approach on this data set for challenges such as insufficient training data and the effect of training samples insufficiency, for which the proposed model provided satisfacory results. Experiments show that our approach has higher accuracy and lower false positive as compared with other methods and the accuracy of the proposed intrusion detection system is 98 percent.