Towards efficient intrusion detection systems based on machine learning techniques

Intrusion Detection System (IDS) have been the key in the network manager daily fight against continuous attacks. However, with the Internet growth, network security issues have become more difficult to handle. Jointly, Machine Learning (ML) techniques for traffic classification have been successful in terms of performance classification. Unfortunately, most of these techniques are extremely CPU time consuming, making the whole approach unsuitable for real traffic situations. In this work, a description of a simple software architecture for ML based is presented together with the first steps towards improving algorithms efficience in some of the proposed modules. A set experiments on the 199 DARPA dataset are conducted in order to evaluate two atribute selecting algorithms considering not only classsification perfomance but also the required CPU time. Preliminary results show that computadtioal effort can be reduced by 50% maintaining similar accuaracy levels, progressing towards a real world implementation of an ML based IDS. Presentado en el V Workshop Arquitectura, Redes y Sistemas Operativos (WARSO) Red de Universidades con Carreras en Informática (RedUNCI)