A survey and taxonomy of the fuzzy signature-based Intrusion Detection Systems

Màsdàrí, Mohàmmàd; Khezri, Hemn

doi:10.1016/j.asoc.2020.106301

Cited by 131 publications

(65 citation statements)

References 85 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Using collected or extracted data by statistical means to detect anomalies can lead to significant errors. In addition, there is no clear boundary between what is abnormal or usual behavior [48] [49]. In this sense, instead of using a hard threshold like classical classification, we used fuzzy logic to provide the recognition of network threats.…”

Section: B Ais Detection Modulementioning

confidence: 99%

“…A Fuzzy Inference System aims to generate an output value supported by fuzzy logic on a given input. It assigns values ranging from 0 to 1 [50] to provide a rational analysis in an environment that has no precise information or incomplete ones [48], as the network traffic analysis. The first step is to fuzzify the input through a membership function, creating a fuzzy set.…”

Section: B Ais Detection Modulementioning

confidence: 99%

See 1 more Smart Citation

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

et al. 2020

View full text Add to dashboard Cite

Software-defined Networking (SDN) has been discovered as an architecture that uses applications to make networks flexible and centrally controlled. Although SDN provides innovative management, it still susceptible to attacks daily. Traditional detection approaches may not be sufficient to contain these threats. In this paper, we present an Artificial Immune System based IDS named AIS-IDS, which is inspired by the human body's defense cells. AIS-IDS can detect variations in network behavior and identify attacks without prior knowledge about them. Along with AIS, the fuzzy logic is applied on detection to minimize the uncertainty when there is no clear boundary between anomalous and normal traffic behavior. We have simulated portscan and flooding attacks as well as used a public dataset with several types of DDoS attacks to assess our proposal. We compared the AIS-IDS performance with Naive Bayes, k-nearest neighbors, and the Local Outlier Factor. The AIS-IDS outperformed the compared algorithms, achieving f-measure rates 99.97% and 92.28% when submitted to a simulated and a public dataset, respectively.

show abstract

Section: B Ais Detection Modulementioning

confidence: 99%

Section: B Ais Detection Modulementioning

confidence: 99%

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

et al. 2020

View full text Add to dashboard Cite

show abstract

“…K-nearest neighbors (KNN): It is an algorithm that calculates and orders the distance from new data to the existing one, classifying this input according to the frequency of the labels of the K-nearest ones. This distance is usually measured by the Euclidian norm presented in Equation (1). For the correct adjustment of this method [36], a correct value of the number of neighbors considered is essential.…”

Section: Machine Learning Algorithms Under Studymentioning

confidence: 99%

“…This process is, traditionally, static and linked to the rules or algorithms used for detecting cyberattacks. Nevertheless, this static process is difficult to adapt to the detection of new types of attacks because it implies updating it with new rules in the cases of signature-based IDS [1], or the re-training of the detection model in the case of anomaly-based IDS [2]. Specifically, anomaly-based IDS are related directly to the application of machine learning (ML) techniques.…”

Section: Introductionmentioning

confidence: 99%

An Approach for the Application of a Dynamic Multi-Class Classifier for Network Intrusion Detection Systems

et al. 2020

View full text Add to dashboard Cite

Currently, the use of machine learning models for developing intrusion detection systems is a technology trend which improvement has been proven. These intelligent systems are trained with labeled datasets, including different types of attacks and the normal behavior of the network. Most of the studies use a unique machine learning model, identifying anomalies related to possible attacks. In other cases, machine learning algorithms are used to identify certain type of attacks. However, recent studies show that certain models are more accurate identifying certain classes of attacks than others. Thus, this study tries to identify which model fits better with each kind of attack in order to define a set of reasoner modules. In addition, this research work proposes to organize these modules to feed a selection system, that is, a dynamic classifier. Finally, the study shows that when using the proposed dynamic classifier model, the detection range increases, improving the detection by each individual model in terms of accuracy.

show abstract

“…Detection is the process of monitoring events that occur in a computer system or network and analyzing them to find signs of accidents. These incidents can be imminent violations or threats to security work policies, accepted policies in the use of the system, or security standards 4 . Influence detection systems focus on identifying possible incidents, incidental information about them, trying to stop them, and reporting them to security managers.…”

Section: Introductionmentioning

confidence: 99%

Introduced a new method for enhancement of intrusion detection with random forest and PSO algorithm

Ajdani

Ghaffary

2021

Security and Privacy

View full text Add to dashboard Cite

As computer networks expand, attacks and intrusions into these networks have increased. In addition to firewalls and other intrusion prevention equipment, other systems, such as IDS (Metrics), are designed to provide enhanced security in computer systems, including the purpose of monitoring intrusive and intrusive activities. Intrusive allocation system can be considered effective if the high intrusion rate is slightly misleading, and in this article a new way to classify it is abnormal (infiltration) in the host or network. UNSW‐NB15 and KDD‐Cup'99 Datasets Introducing Random Forest and PSO algorithm. In this paper, training data and label data used with the random forest algorithm. After creating a random forest algorithm, provide test data. We use the data stored in train step, which is actually a copy of the data, so that when performing the test step, the same training data can be compared with categorize using a PSO algorithm. In in order to show the accuracy of the proposed method, an example of the confusion matrix formed in the code that showed performance of all methods and modes studied is compared based on accuracy and time that the PSO algorithm has always been able to take less time, which is quite acceptable and predictable. Improves correct diagnosis of correct detection rate in that report was 75.94% and in the proposed method in this article it reached 97%. With the proposed method, learning speed has been greatly increased and accuracy is acceptable.

show abstract

A survey and taxonomy of the fuzzy signature-based Intrusion Detection Systems

Cited by 131 publications

References 85 publications

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

An Approach for the Application of a Dynamic Multi-Class Classifier for Network Intrusion Detection Systems

Introduced a new method for enhancement of intrusion detection with random forest and PSO algorithm

Contact Info

Product

Resources

About