A Comparative study of machine learning models for Network Intrusion Detection System using UNSW-NB 15 dataset

Disha, Raisa Abedin; Waheed, Sajjad

doi:10.1109/icecit54077.2021.9641471

Cited by 16 publications

(5 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They are classifiable using both binary as well a multi-classification framework. Since we obtained the best results with tree-based classifiers (DT, RF, and GBT), our results are also congruent with previous work using network attack data, which showns that RF [12,17] or DT performed best [9,13]. If we take training time into consideration, decision trees can be considered the most efficient classifier for the UWF-ZeekDataFall22 dataset, labeled using the MITRE ATT&CK framework.…”

Section: Discussionsupporting

confidence: 89%

See 1 more Smart Citation

Introducing the UWF-ZeekDataFall22 Dataset to Classify Attack Tactics from Zeek Conn Logs Using Spark’s Machine Learning in a Big Data Framework

Bagui,

Mink,

Bagui

et al. 2023

Electronics

View full text Add to dashboard Cite

This study introduces UWF-ZeekDataFall22, a newly created dataset labeled using the MITRE ATT&CK framework. Although the focus of this research is on classifying the never-before classified resource development tactic, the reconnaissance and discovery tactics were also classified. The results were also compared to a similarly created dataset, UWF-ZeekData22, created in 2022. Both of these datasets, UWF-ZeekDataFall22 and UWF-ZeekData22, created using Zeek Conn logs, were stored in a Big Data Framework, Hadoop. For machine learning classification, Apache Spark was used in the Big Data Framework. To summarize, the uniqueness of this work is its focus on classifying attack tactics. For UWF-ZeekdataFall22, the binary as well as the multinomial classifier results were compared, and overall, the results of the binary classifier were better than the multinomial classifier. In the binary classification, the tree-based classifiers performed better than the other classifiers, although the decision tree and random forest algorithms performed almost equally well in the multinomial classification too. Taking training time into consideration, decision trees can be considered the most efficient classifier.

show abstract

Section: Discussionsupporting

confidence: 89%

“…In yet another comparative study, Disha and Waheed (2021) [13] used the GBT classifier for binary classification to determine network intrusions using the UNSW-NB15 dataset. A Chi-squared test was used to remove irrelevant features, and GBT was discovered to have the highest accuracy after decision trees.…”

Section: Related Workmentioning

confidence: 99%

Introducing the UWF-ZeekDataFall22 Dataset to Classify Attack Tactics from Zeek Conn Logs Using Spark’s Machine Learning in a Big Data Framework

Bagui,

Mink,

Bagui

et al. 2023

Electronics

View full text Add to dashboard Cite

show abstract

“…The final selected features were 23, which were filtered from 42 features given in the dataset. A binary classification based upon the UNSW-NB15 dataset is applied and Decision Tree (DT) was found as the best classifier among five different applied ML classifiers [29]. The chi-square feature selection method is applied for feature selection and then uses 5 ML classifiers to classify the UNSW-NB15 dataset.…”

Section: Related Workmentioning

confidence: 99%

An Efficient NIDPS with Improved Salp Swarm Feature Optimization Method

Alabrah

2023

Applied Sciences

View full text Add to dashboard Cite

Network security problems arise these days due to many challenges in cyberspace. The malicious attacks on installed wide networks are rapidly spreading due to their vulnerability. Therefore, the user and system information are at high risk due to network attacks. To protect networks against these attacks, Network Intrusion Detection and Prevention Systems (NIDPS) are installed on them. These NIDPS can detect malicious attacks by monitoring abnormal behavior and patterns in network traffic. These systems were mainly developed using Artificial Intelligence (AI) algorithms. These intelligent NIDPS are also able to detect the attack type while detecting network attacks. Previous studies have proposed many NIDPS for network security. However, many challenges exist so far such as limited available data for training AI algorithms, class imbalance problems, and automated selection of the most important features. These problems need to be solved first, which will lead to the precise detection of network attacks. Therefore, the proposed framework used the highly imbalanced UNSW-NB15 dataset for binary and multiclass classification of network attacks. In this framework, firstly dataset normalization is applied using standard deviation and the mean of feature columns; secondly, an Improved Salp Swarm Algorithm (ISSA) is applied for automated feature selection separately on binary and multiclass subsets. Thirdly, after applying feature selection, the SMOTE–Tomek class balancing method is applied where at least four different ML classifiers are used for binary and multiclass classification. The achieved results outperformed as compared to previous studies and improved the overall performance of NIDPS.

show abstract

“…This experiment had an accuracy value of 98.36%. Disha and Waheed [22] developed a backward elimination-based feature selection method to enhance attack detection accuracy on computer networks. The Chi-square value of each feature is utilised to implement this technique.…”

Section: Related Workmentioning

confidence: 99%

Feature Selection for Intrusion Detection Using Independence Level Test with an Exhaustive Approach

2023

IJIES

View full text Add to dashboard Cite

The intrusion detection system (IDS) has been developed to detect attacks or suspicious activity on a network. IDS are generally classified into two types: signature-based and anomaly detection. Many studies widely use anomaly-based detection because it can detect new types of attacks on the internet network, but it has several shortcomings. Handling data with high dimensionality directly to the classification process could lead to low accuracy and increased false alarm rates. Selecting relevant features and removing irrelevant features from classification results could be the solution to overcome this issue. In this research, we propose an intrusion detection model using a combination of the Chi-square independence test and an exhaustive search. Firstly, this proposed method employs the independence levels of the Chi-square test to calculate the statistical scores for each feature. The feature list obtained from the first process is continued to the optimisation stage using an exhaustive search. This process aims to calculate the accuracy values of all possible feature combinations from the early-stage feature list and check each feature combination to see if that combination has the best accuracy. This method was tested on four datasets: KDD Cup 99, NSL-KDD, Kyoto 2006+, and UNSW-NB15 using three classifiers: Support vector machine, decision tree, and Naive Bayes. This method achieved the highest accuracy when tested on the UNSW-NB15 dataset using the SVM. Accuracy, precision, recall, and F-score reached values above 95%. Likewise, the FPR value reached the lowest rate of 1.56%.

show abstract

A Comparative study of machine learning models for Network Intrusion Detection System using UNSW-NB 15 dataset

Cited by 16 publications

References 15 publications

Introducing the UWF-ZeekDataFall22 Dataset to Classify Attack Tactics from Zeek Conn Logs Using Spark’s Machine Learning in a Big Data Framework

Introducing the UWF-ZeekDataFall22 Dataset to Classify Attack Tactics from Zeek Conn Logs Using Spark’s Machine Learning in a Big Data Framework

An Efficient NIDPS with Improved Salp Swarm Feature Optimization Method

Feature Selection for Intrusion Detection Using Independence Level Test with an Exhaustive Approach

Contact Info

Product

Resources

About