Online Naive Bayes classification for network intrusion detection

Abstract

Intrusion detection system (IDS) is an important component to ensure network security. In this paper we build an online Naïve Bayes classifier to discriminate normal and bad (intrusion) connections on KDD 99 dataset for network intrusion detection. The classifier starts with a small number of training examples of normal and bad classes; then, as it classifies the rest of the samples one at a time, it continuously updates the mean and the standard deviations of the features (IDS variables). We present experimental results of parameter updating methods and their parameters for the online Naïve Bayes classifier. The obtained results show that our proposed method performs comparably to the simple incremental update.