An efficient and robust deep learning based network anomaly detection against distributed denial of service attacks

Kasım, Ömer

doi:10.1016/j.comnet.2020.107390

Cited by 74 publications

(37 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Figure 6(b) shows that the accuracy of proposed approach is 98.92% and Naïve model has a low accuracy of 93%. The accuracy of proposed approach is slightly lower than 99.41% of AE+SVM [35]. The proposed approach outperformed SVM method which achieved 88.18% accuracy on CICIDS2017.…”

Section: Resultsmentioning

confidence: 81%

“…The comparison has been done over the NSL-KDD and CICIDS2017 standard datasets. The approaches chosen for comparison over NSL-KDD dataset are SAE+SMR [18], AE+Gaussian NB [20], RNN [21], MLP [22], AE+SVM [35], and SAVAER+DNN [39]. The approaches chosen for comparison over CICIDS2017 dataset are DT [32], ANN [32], SVM [32], LSTM [32] and SAVAER+DNN [39].…”

Section: Resultsmentioning

confidence: 99%

“…Content may change prior to final publication. Citation information: DOI 10.1109/ACCESS.2020.3028690, IEEE Access [18] NSL-KDD 88.39% ------AE+ Gaussian Naïve Bayes [20] NSL-KDD 83.34% ------RNN [21] NSL-KDD 83.28% ------MLP [22] NSL-KDD 91.7% ------AE+ SVM [35] NSL Apart from analyzing the four performance metrics as given above, we have plotted the epoch versus accuracy graph for optimized AE+DNN in Figure 7 to show the convergence of the algorithm. As the graph indicates, the proposed optimized AE+DNN is stable with reasonably fast convergence.…”

Section: Resultsmentioning

confidence: 99%

“…SVM and AE based combined method is proposed by authors in [35]. AE was trained with optimal hyperparameters which helps in dimensionality reduction and feature extraction.…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

2020

View full text Add to dashboard Cite

Cloud computing has very attractive features like elastic, on demand and fully managed computer system resources and services. However, due to its distributed and dynamic nature as well as vulnerabilities in virtualization implementation, the cloud environment is prone to various cyber-attacks and security issues related to cloud model. Some of them are inability to access data coming to and from cloud service, theft and misuse of data hosted, no control over sensitive data access, advance threats like malware injection attack, wrapping attacks, virtual machine escape, distributed denial of service attack (DDoS) etc. DDoS is one of the notorious attack. Despite a number of available potential solutions for the detection of DDoS attacks, the increasing frequency and potency of recent attacks and the constantly evolving attack vectors, necessitate the development of improved detection approaches. This paper proposes a novel architecture that combines a well posed stacked sparse AutoEncoder (AE) for feature learning with a Deep Neural Network (DNN) for classification of network traffic into benign traffic and DDoS attack traffic. AE and DNN are optimized for detection of DDoS attacks by tuning the parameters using appropriately designed techniques. The improvements suggested in this paper lead to low reconstruction error, prevent exploding and vanishing gradients, and lead to smaller network which avoids overfitting. A comparative analysis of the proposed approach with ten state-of-the-art approaches using performance metrics-detection accuracy, precision, recall and F1-Score, has been conducted. Experiments have been performed on CICIDS2017 and NSL-KDD standard datasets for validation. Proposed approach outperforms existing approaches over the NSL-KDD dataset and yields competitive results over the CICIDS2017 dataset.

show abstract

Section: Resultsmentioning

confidence: 81%

Section: Resultsmentioning

confidence: 99%

Section: Resultsmentioning

confidence: 99%

“…SVM and AE based combined method is proposed by authors in [35]. AE was trained with optimal hyperparameters which helps in dimensionality reduction and feature extraction.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

2020

View full text Add to dashboard Cite

show abstract

“…Comparison with exisiting models could be done extensively especially for novel approaches. Authors proposed methods and tested on the dataset of CICIDS with the precision of 99.1% in [48]. Weighted Extreme Learning Machine (ELM) method was proposed for the intrusion detection and the results showed precision of around 99% in [49,50].…”

Section: Related Researchesmentioning

confidence: 99%

Application of Improved Asynchronous Advantage Actor Critic Reinforcement Learning Model on Anomaly Detection

Zhou

Wang

et al. 2021

Entropy

View full text Add to dashboard Cite

Anomaly detection research was conducted traditionally using mathematical and statistical methods. This topic has been widely applied in many fields. Recently reinforcement learning has achieved exceptional successes in many areas such as the AlphaGo chess playing and video gaming etc. However, there were scarce researches applying reinforcement learning to the field of anomaly detection. This paper therefore aimed at proposing an adaptable asynchronous advantage actor-critic model of reinforcement learning to this field. The performances were evaluated and compared among classical machine learning and the generative adversarial model with variants. Basic principles of the related models were introduced firstly. Then problem definitions, modelling processes and testing were detailed. The proposed model differentiated the sequence and image from other anomalies by proposing appropriate neural networks of attention mechanism and convolutional network for the two kinds of anomalies, respectively. Finally, performances with classical models using public benchmark datasets (NSL-KDD, AWID and CICIDS-2017, DoHBrw-2020) were evaluated and compared. Experiments confirmed the effectiveness of the proposed model with the results indicating higher rewards and lower loss rates on the datasets during training and testing. The metrics of precision, recall rate and F1 score were higher than or at least comparable to the state-of-the-art models. We concluded the proposed model could outperform or at least achieve comparable results with the existing anomaly detection models.

show abstract

Performance evaluation of machine learning models for distributed denial of service attack detection using improved feature selection and hyper‐parameter optimization techniques

Habib

Khursheed

2022

Concurrency and Computation

View full text Add to dashboard Cite

This article gives the framework of extensive experimentation of various machine learning models to detect distributed denial of service attacks (DDoS). We use six-tier feature ranking methods that use statistical techniques as well as machine learning based classifiers to obtain the significant features. The measurable statistical based feature selection involves Chi-Square (Chi2), information gain (IG), merged Chi-Square (Chi2)-IG ranking and machine learning classifiers involve ensemble classifiers, that is, decision tree, random forest and eXtreme gradient boosting (XGBoost). Different supervised machine learning models (logistic regression, decision tree classifier, linear support vector machine, k-nearest neighbors, Gaussian Naive Bayes, random forest classifier, XGBoost) are trained on a feature-engineered datasets. To further our research, we use neural networks (ANN and CNN) using both feature-selected and auto-feature selection training setup. We check the validation and adaptability of these models with the optimal tuning of various parameters using GridSearchCV and the effectiveness of random sampling in overcoming the class imbalance problem. Based on various feature selection methods, the models are evaluated for their best performance. The experimental results show that our trained machine learning models and neural networks outperformed the ones in the state of art. The performance analysis is done based on confusion matrix scores, that is, accuracy, false alarm rate, sensitivity, specificity, false-positive rate, F1 score, area under curve analysis and loss functions on well-known KDD Cup 99 and UNSW-NB15 datasets. This study is significant for furthering the research in DDoS detection with machine learning and deep neural networks.

show abstract

An efficient and robust deep learning based network anomaly detection against distributed denial of service attacks

Cited by 74 publications

References 23 publications

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

Application of Improved Asynchronous Advantage Actor Critic Reinforcement Learning Model on Anomaly Detection

Performance evaluation of machine learning models for distributed denial of service attack detection using improved feature selection and hyper‐parameter optimization techniques

Contact Info

Product

Resources

About