Efficient Classification of Portscan Attacks using Support Vector Machine

Support Vector Machine, a powerful data mining technique is used for the classification of attacks. SVM is implemented using WEKA tool in which the Radial Basis Function proves to be an efficient Kernel for the classification of portscan attacks. KDD'99 dataset consisting of portscan and normal traces termed as mixed traffic is given as input to SVM in two phases, i.e., without feature reduction and with feature reduction using Consistency Subset Evaluation algorithm and Best First search method. In the first phase, the mixed traffic as a whole is given as input to SVM. In the second phase, feature reduction algorithm is applied over the mixed traffic and then fed to SVM. Finally the performance is compared in accordance with classification between the two phases. The performance of the proposed method is measured using false positive rate and computation time.