An End-to-End Framework for Machine Learning-Based Network Intrusion Detection System

Abstract

The increase of connected devices and the constantly evolving methods and techniques by attackers pose a challenge for network intrusion detection systems from conception to operation. As a result, we see a constant adoption of machine learning algorithms for network intrusion detection systems. However, the dataset used by these studies has become obsolete regarding both background and attack traffic. This work describes the AB-TRAP framework that enables the use of updated network traffic and considers operational concerns to enable the complete deployment of the solution. AB-TRAP is a fivestep framework consisting of (i) the generation of the attack dataset, (ii) the bonafide dataset, (iii) training of machine learning models, (iv) realization (implementation) of the models, and (v) the performance evaluation of the realized model after deployment. We exercised the AB-TRAP for local (LAN) and global (internet) environments to detect TCP port scanning attacks. The LAN study case presented an f1-score of 0.96, and an area under the ROC curve of 0.99 using a decision tree with minimal CPU and RAM usage on kernel-space. For the internet case with eight machine learning algorithms with an average f1-score of 0.95, an average area under the ROC curve of 0.98, and an average overhead of 1.4% CPU and 3.6% RAM on user-space in a single-board computer. This framework has the following paramount characteristics: it is reproducible, uses the most up-to-date network traffic, attacks, and addresses the concerns to the model's realization and deployment. INDEX TERMS cybersecurity, datasets, intrusion detection system, machine learning, network security, supervised learning NOMENCLATURE AU C Area Under the Curve. B5G 5G and beyond. CoAP Constrained Application Protocol. CP S Cyber-Physical System. CSV Comma-separated values. DDoS Distributed Denial of Service. DL Deep Learning. DN P 3 Distributed Network Protocol 3. DoS Denial of Service.

Composition of Hybrid Deep Learning Model and Feature Optimization for Intrusion Detection System

“…Gustavo et al [ 16 ] introduced the AB-TRAP framework to facilitate the full deployment of the solution, which allows the use of new network traffic and takes operational factors into account. Their methodology includes developing attack and legitimate datasets, training machine learning models, putting the solution into practice on a target system, and assessing the effectiveness of the security module.…”

Reproducing Random Forest Efficacy in Detecting Port Scanning

“…Sirisha et al [20] used the KDDTrain+ and KDDTest+ files. However, Bertoli et al [19] noted limitations of the data which rendered use of the data in ML-based solutions impractical.…”

Detecção incremental de comportamento malicioso em VANETs

“…Como destacado em [De Carvalho Bertoli et al 2021], além de produzir modelos de aprendizado, o passo no sentido de sua operacionalizac ¸ão (MLOps) é importante. Logo, a observância de modelos plausíveis de implementac ¸ão nos dispositivos-alvo deve ser considerado.…”