A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems

Hindy, Hanan; Brosset, David; Bayne, Ethan; Seeam, Amar; Tachtatzis, Christos; Atkinson, Robert; Bellekens, Xavier

doi:10.1109/access.2020.3000179

Cited by 155 publications

(112 citation statements)

References 129 publications

Supporting

Mentioning

110

Contrasting

Unclassified

Order By: Relevance

“…Kharon malware dataset was collected in 2016 to gauge the performance of research experiments [184]. Kharon malware dataset is a collection of android documented malware attacks [185].…”

Section: B Com M Only Used Security Datasetsmentioning

confidence: 99%

A Survey on Machine Learning Techniques for Cyber Security in the Last Decade

et al. 2020

View full text Add to dashboard Cite

Pervasive growth and usage of the Internet and mobile applications have expanded cyberspace. The cyberspace has become more vulnerable to automated and prolonged cyberattacks. Cyber security techniques provide enhancements in security measures to detect and react against cyberattacks. The previously used security systems are no longer sufficient because cybercriminals are smart enough to evade conventional security systems. Conventional security systems lack efficiency in detecting previously unseen and polymorphic security attacks. Machine learning (ML) techniques are playing a vital role in numerous applications of cyber security. However, despite the ongoing success, there are significant challenges in ensuring the trustworthiness of ML systems. There are incentivized malicious adversaries present in the cyberspace that are willing to game and exploit such ML vulnerabilities. This paper aims to provide a comprehensive overview of the challenges that ML techniques face in protecting cyberspace against attacks, by presenting a literature on ML techniques for cyber security including intrusion detection, spam detection, and malware detection on computer networks and mobile networks in the last decade. It also provides brief descriptions of each ML method, frequently used security datasets, essential ML tools, and evaluation metrics to evaluate a classification model. It finally discusses the challenges of using ML techniques in cyber security. This paper provides the latest extensive bibliography and the current trends of ML in cyber security.

show abstract

“…Kharon malware dataset was collected in 2016 to gauge the performance of research experiments [184]. Kharon malware dataset is a collection of android documented malware attacks [185].…”

Section: B Com M Only Used Security Datasetsmentioning

confidence: 99%

A Survey on Machine Learning Techniques for Cyber Security in the Last Decade

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The feature extraction task is responsible for distilling meaningful features 0 x 0 from the captured and parsed network traffic. Feature selection [34] has key importance in determining the accuracy of an intrusion detection system. IDSIoT-SDL uses deep learning feature extraction from the captured data.…”

Section: Activity Analysermentioning

confidence: 99%

“…The dataset for training machine/deep learning algorithms for IDS mainly include KDD Cup'99, NSD-KDD, UNB ISCX, DARPA KDD [34]. The CSE-CIC-IDS2018 is used as dataset for training in IDSIoT-SDL [35].…”

Section: Dataset For Idsiot-sdlmentioning

confidence: 99%

SDN‐based intrusion detection system for IoT using deep learning classifier (IDSIoT‐SDL)

Wani

Revathi

Khaliq

2021

CAAI Trans on Intel Tech

View full text Add to dashboard Cite

The participation of ordinary devices in networking has created a world of connected devices rapidly. The Internet of Things (IoT) includes heterogeneous devices from every field. There are no definite protocols or standards for IoT communication, and most of the IoT devices have limited resources. Enabling a complete security measure for such devices is a challenging task, yet necessary. Many lightweight security solutions have surfaced lately for IoT. The lightweight security protocols are unable to provide an optimum protection against prevailing powerful threats in cyber world. It is also hard to deploy any traditional security protocol on resource-constrained IoT devices. Softwaredefined networking introduces a centralized control in computer networks. SDN has a programmable approach towards networking that decouples control and data planes. An SDN-based intrusion detection system is proposed which uses deep learning classifier for detection of anomalies in IoT. The proposed intrusion detection system does not burden the IoT devices with security profiles. The proposed work is executed on the simulated environment. The results of the simulation test are evaluated using various matrices and compared with other relevant methods. This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

show abstract

“…As mentioned, the detection of cyber-attacks is an established research area that has leveraged a range of technologies as it has evolved over the years [ 7 ] to cope with the exponential growth of cyber-attacks [ 8 ]. A range of ML-based models have been applied to the problem, including support vector machines, artificial neural networks, and k-means clustering [ 9 ]. Despite the discriminative power of these models, many cyber-attacks still remain undetected or have low rates of detection.…”

Section: Background and Related Workmentioning

confidence: 99%

Utilising Flow Aggregation to Classify Benign Imitating Attacks

Hindy

Atkinson

Tachtatzis

et al. 2021

Sensors

Self Cite

View full text Add to dashboard Cite

Cyber-attacks continue to grow, both in terms of volume and sophistication. This is aided by an increase in available computational power, expanding attack surfaces, and advancements in the human understanding of how to make attacks undetectable. Unsurprisingly, machine learning is utilised to defend against these attacks. In many applications, the choice of features is more important than the choice of model. A range of studies have, with varying degrees of success, attempted to discriminate between benign traffic and well-known cyber-attacks. The features used in these studies are broadly similar and have demonstrated their effectiveness in situations where cyber-attacks do not imitate benign behaviour. To overcome this barrier, in this manuscript, we introduce new features based on a higher level of abstraction of network traffic. Specifically, we perform flow aggregation by grouping flows with similarities. This additional level of feature abstraction benefits from cumulative information, thus qualifying the models to classify cyber-attacks that mimic benign traffic. The performance of the new features is evaluated using the benchmark CICIDS2017 dataset, and the results demonstrate their validity and effectiveness. This novel proposal will improve the detection accuracy of cyber-attacks and also build towards a new direction of feature extraction for complex ones.

show abstract

A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems

Cited by 155 publications

References 129 publications

A Survey on Machine Learning Techniques for Cyber Security in the Last Decade

A Survey on Machine Learning Techniques for Cyber Security in the Last Decade

SDN‐based intrusion detection system for IoT using deep learning classifier (IDSIoT‐SDL)

Utilising Flow Aggregation to Classify Benign Imitating Attacks

Contact Info

Product

Resources

About