Incremental decision tree

Machine learning

Data mining

Engineering

Anomaly-based intrusion detection system

Aerospace engineering

Pattern recognition (psychology)

Artificial intelligence

False alarm

ALARM

Intrusion detection system

Computer science

Decision tree learning

Constant false alarm rate

Decision tree

Classifier (UML)

This paper proposes a novel intrusion detection system (IDS) that combines different classifier approaches which are based on decision tree and rules-based concepts, namely, REP Tree, JRip algorithm and Forest PA. Specifically, the first and second method take as inputs features of the data set, and classify the network traffic as Attack/Benign. The third classifier uses features of the initial data set in addition to the outputs of the first and the second classifier as inputs. The experimental results obtained by analyzing the proposed IDS using the CICIDS2017 dataset, attest their superiority in terms of accuracy, detection rate, false alarm rate and time overhead as compared to state of the art existing schemes.

A Novel Hierarchical Intrusion Detection System Based on Decision Tree and Rules-Based Models