Intrusion detection under covariate shift using modified support vector machine and modified backpropagation

In this paper, we address the dataset shift problem in building intrusion detection systems by assuming that network traffic variants follow the covariate shift model. Based on two recent works on direct density ratio estimation which are kernel mean matching and unconstrained least squares importance fitting, we propose to modify two well-known classification techniques: neural networks with back propagation and support vector machine in order to make these techniques work better under covariate shift effect. We evaluated the modified techniques on a benchmark intrusion detection dataset, the KDD Cup 1999, and got higher results on predication accuracy of network behaviors compared with the original techniques.