Predictor Selection and Attack Classification using Random Forest for Intrusion Detection

Abstract

Decision making for intrusion detection is critical in a distributed environment such as cloud or grid computing due to its’ dynamic nature. Wrong or delayed decisions lead to astonishing problems. So that decision making phase is enhanced by means of selecting relevant features for prediction and trained to classify attacks. Initially the common valued features for both normal and attack behavior are removed. The random forest algorithm is used for analyzing the predictors’ importance for intrusion detection. Then random forest algorithm works with the reduced and selected predictors to classify the normal user and attack behavior. Finally the classifications are used to detect intruders. Experiments are conducted and proved that classifier performance can be improved in terms of accuracy, efficiency and detection rate using random forest.