Designing a hybrid approach with computational analysis and visual analytics to detect network intrusions

As network traffic has become more prevalent and complex, understanding network traffic patterns is vital to design innovative detection methods. Researchers have proposed various intrusion detection techniques by integrating different machine learning algorithms, but these techniques commonly share a high false-positive rate problem. In this study, we propose a hybrid approach of integrating computational analysis with visual analytics to detect network intrusions. For the computational analysis, both Multi-Resolution Analysis (MRA) and Principal Component Analysis (PCA) are applied to analyze network traffic data. First, Discrete Wavelet Transform (DWT) is utilized as the MRA approach to extract features from the network traffic data. After determining statistically significant features from a statistical validation, PCA is applied to transform the extracted features for identifying principal components in eigenspace. Lastly, a visual analytics tool is designed to help the user conduct an interactive visual analysis on detected network intrusions by initiating interactive visual validation and verification. We found that our approach is useful to detect the network intrusions as well as to understand their patterns.