Cascaded classifier approach based on Adaboost to increase detection rate of rare network attack categories

Network intrusion detection often finds a difficulty in creating classifiers that could handle unequal distributed attack categories. Generally R2L and U2R attacks are very rare attacks and even in KDD Cup99 dataset, these attacks are only 2% of overall datasets. So, these result in model not able to efficiently learn the characteristics of rare categories and this will result in poor detection rates of rare attack categories like R2L and U2R attacks. We introduce a new approach called cascading classification model based on AdaBoost and Bayesian Network Classifier that can improve the detection rate of rare network attack categories. In this approach we train two classifiers with two different training sets. The KDD Cup99 dataset was splitted into two training sets where one contains full of non rare attacks datasets and other contains datasets of rare attack categories. This cascaded classifier approach increases the detection rates of both rare network attack categories and also it increase overall detection rate of an IDS model. The higher detection rates are due to the mitigation of the influence from the dominant categories if the rare attack categories are separated from the dataset.