An Approach for the Application of a Dynamic Multi-Class Classifier for Network Intrusion Detection Systems

Larriva-Novo, Xavier; Sánchez-Zas, Carmen; Villagrá, Víctor A.; Vega-Barbas, Mario; Rivera, Diego

doi:10.3390/electronics9111759

Cited by 8 publications

(4 citation statements)

References 35 publications

(63 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The use of all training data, following the approach in [ 58 ], could further improve the results here presented. Moreover, additional efforts are required to test the suitability of our methodology in multiclass classification problems in cybersecurity (as those in [ 59 , 60 ]).…”

Section: Discussionmentioning

confidence: 99%

A Compression-Based Method for Detecting Anomalies in Textual Data

Torre-Abaitua

Lago-Fernández

Arroyo

2021

Entropy

View full text Add to dashboard Cite

Nowadays, information and communications technology systems are fundamental assets of our social and economical model, and thus they should be properly protected against the malicious activity of cybercriminals. Defence mechanisms are generally articulated around tools that trace and store information in several ways, the simplest one being the generation of plain text files coined as security logs. Such log files are usually inspected, in a semi-automatic way, by security analysts to detect events that may affect system integrity, confidentiality and availability. On this basis, we propose a parameter-free method to detect security incidents from structured text regardless its nature. We use the Normalized Compression Distance to obtain a set of features that can be used by a Support Vector Machine to classify events from a heterogeneous cybersecurity environment. In particular, we explore and validate the application of our method in four different cybersecurity domains: HTTP anomaly identification, spam detection, Domain Generation Algorithms tracking and sentiment analysis. The results obtained show the validity and flexibility of our approach in different security scenarios with a low configuration burden.

show abstract

Section: Discussionmentioning

confidence: 99%

A Compression-Based Method for Detecting Anomalies in Textual Data

Torre-Abaitua

Lago-Fernández

Arroyo

2021

Entropy

View full text Add to dashboard Cite

show abstract

“…As a result of the experimental study, 93.21% detection accuracy was achieved for UNSW-NB15 dataset and 99.41% accuracy was achieved for DS2OS dataset. The IDS proposed by Larriva-Novo et al [19] was developed with an XGBoost-based ensemble ML model called the Dynamic Multiclass Classifier, and the performance test of the proposed IDS was carried out with the UNSW-NB15 dataset. Kendall Coefficient and K-Best feature selection methods were applied for the selection of the most significant features from the dataset.…”

Section: Literature Reviewmentioning

confidence: 99%

A Hybrid PCA-MAO Based LSTM Model for Intrusion Detection in IoT Environments

Karamollaoglu

Yücedağ

Doğru

2022

Preprint

View full text Add to dashboard Cite

With the rapid advances in Internet of Things (IoT) technologies, the number of smart objects connected to IoT networks is increasing day by day. Parallel to this exponential growth, attacks against IoT networks are also increasing rapidly. Various Intrusion Detection Systems (IDS) have been proposed by researchers to improve accuracy in detecting attacks with different behaviors and reduce intrusion detection time. This work presents a novel IDS based on the combination of the Principal Component Analysis and Mayfly Optimization methods (PCA-MAO) for dimensionality reduction, the Borderline Synthetic Minority Oversampling Technique (BSMOTE) for data balancing, and the Long Short-Term Memory (LSTM) method for classification. A new dataset was created by combining IoTID20, CIC-ToN-IoT and USB-IDS-1 datasets to be used in the performance test of the proposed model. Thus, the performance evaluation of the proposed model was performed for more attack types with different behaviors. As a result of classification using the proposed hybrid PCA-MAO based LSTM model, an accuracy of 99.51% was obtained. It has been observed that the proposed IDS provides superior intrusion detection performance for high-dimensional, complicated, and imbalanced data compared to classical machine learning (ML) methods.

show abstract

“…Larriva-Novo et al [18] investigated the performance of a set of single learners on the UNSW-NB15 dataset, from which seven best-performing learners are used to form the base learners. The learners are combined using XGBoost as the meta-learner for the final classification.…”

Section: Related Workmentioning

confidence: 99%

IoT Network Intrusion Detection with Ensemble Learners

Abdulkareem

Foh

Lee

et al. 2022

2022 13th International Conference on Information and Communication Technology Convergence (ICTC)

View full text Add to dashboard Cite

Protecting information systems against intruders' attacks requires utilising intrusion detection systems. Over the past several years, many open-source intrusion datasets have been made available so that academics and researchers can analyse and assess various detection classifiers' effectiveness. These datasets are made available with a full complement of illustrative network features. In this research, we investigate the issue of Network Intrusion Detection (NID) by utilising an Internet of Things (IoT) dataset called Bot-IoT to evaluate the detection efficiency and effectiveness of five different Ensemble Learning Classifiers (ELCs). Our experiment's results showed that despite all ELCs recording high classification metric scores, CatBoost emerged as the ELC that performed the best in our experiment in terms of Accuracy, Precision, F1-Score, Training and Test Time.

show abstract

An Approach for the Application of a Dynamic Multi-Class Classifier for Network Intrusion Detection Systems

Cited by 8 publications

References 35 publications

A Compression-Based Method for Detecting Anomalies in Textual Data

A Compression-Based Method for Detecting Anomalies in Textual Data

A Hybrid PCA-MAO Based LSTM Model for Intrusion Detection in IoT Environments

IoT Network Intrusion Detection with Ensemble Learners

Contact Info

Product

Resources

About