University of Hertfordshire

  • Ruchi Jain
  • Nasser Abouzakhar
View graph of relations
Original languageEnglish
Pages (from-to)176-184
Number of pages9
JournalInternational Journal of Internet Technology and Secured Transactions (JITST)
Publication statusPublished - Dec 2013


This paper aims to analyse the performance of Hidden Markov Model (HMM) and Support Vector Machine (SVM) for anomaly intrusion detection. These techniques discriminate between normal and abnormal behaviour of network traffic. The specific focus of this study is to investigate and identify distinguishable TCP services that comprise of both normal and abnormal types of TCP packets, using J48 decision tree algorithm. The publicly available KDD Cup 1999 dataset has been used in training and evaluation of such techniques. Experimental results demonstrate that the HMM is able to classify network traffic with approximately 76% to 99% accuracy while SVM classifies it with approximately 80% to 99% accuracy.

ID: 2819567