An IoT-Focused Intrusion Detection System Approach Based on Preprocessing Characterization for Cybersecurity Datasets

Larriva-Novo, Xavier; Villagrá, Víctor A.; Vega-Barbas, Mario; Rivera, Diego; Sanz, Mario

doi:10.3390/s21020656

Cited by 68 publications

(28 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The KDD99 dataset. It has been derived from the DARPA98 dataset and it is made of 49 M of single connection features with 41 attributes [10,11]. These features are labelled as normal network threats or not.…”

mentioning

confidence: 99%

UGRansome1819: A Novel Dataset for Anomaly Detection and Zero-Day Threats

2021

View full text Add to dashboard Cite

This research attempts to introduce the production methodology of an anomaly detection dataset using ten desirable requirements. Subsequently, the article presents the produced dataset named UGRansome, created with up-to-date and modern network traffic (netflow), which represents cyclostationary patterns of normal and abnormal classes of threatening behaviours. It was discovered that the timestamp of various network attacks is inferior to one minute and this feature pattern was used to record the time taken by the threat to infiltrate a network node. The main asset of the proposed dataset is its implication in the detection of zero-day attacks and anomalies that have not been explored before and cannot be recognised by known threats signatures. For instance, the UDP Scan attack has been found to utilise the lowest netflow in the corpus, while the Razy utilises the highest one. In turn, the EDA2 and Globe malware are the most abnormal zero-day threats in the proposed dataset. These feature patterns are included in the corpus, but derived from two well-known datasets, namely, UGR’16 and ransomware that include real-life instances. The former incorporates cyclostationary patterns while the latter includes ransomware features. The UGRansome dataset was tested with cross-validation and compared to the KDD99 and NSL-KDD datasets to assess the performance of Ensemble Learning algorithms. False alarms have been minimized with a null empirical error during the experiment, which demonstrates that implementing the Random Forest algorithm applied to UGRansome can facilitate accurate results to enhance zero-day threats detection. Additionally, most zero-day threats such as Razy, Globe, EDA2, and TowerWeb are recognised as advanced persistent threats that are cyclostationary in nature and it is predicted that they will be using spamming and phishing for intrusion. Lastly, achieving the UGRansome balance was found to be NP-Hard due to real life-threatening classes that do not have a uniform distribution in terms of several instances.

show abstract

mentioning

confidence: 99%

UGRansome1819: A Novel Dataset for Anomaly Detection and Zero-Day Threats

2021

View full text Add to dashboard Cite

show abstract

“…The data preprocess consists of transforming the data values of a specific dataset, aiming to optimize the information acquisition and process. As there is a contrast between the maximum and minimum values of the dataset, normalizing the data minimizes the algorithm’s complexity for its corresponding processing [ 51 ]. Data processing covered three procedures: eliminating extreme values, eliminating outliers, and standardizing data.…”

Section: Methodsmentioning

confidence: 99%

“…Data standardization was then followed as data were collected from the different sensors with a variety of measurements. The most common standardizing data approaches include z-score normalization, min-max standardization, distance to target normalization, and ranking normalization [ 51 , 54 ]. The Z-score normalization approach will be used in this research.…”

Section: Methodsmentioning

confidence: 99%

A comparative analysis of the principal component analysis and entropy weight methods to establish the indexing measurement

Zhang

Yan

et al. 2022

PLoS ONE

View full text Add to dashboard Cite

Background As the world’s largest coal producer, China was accounted for about 46% of global coal production. Among present coal mining risks, methane gas (called gas in this paper) explosion or ignition in an underground mine remains ever-present. Although many techniques have been used, gas accidents associated with the complex elements of underground gassy mines need more robust monitoring or warning systems to identify risks. This paper aimed to determine which single method between the PCA and Entropy methods better establishes a responsive weighted indexing measurement to improve coal mining safety. Methods Qualitative and quantitative mixed research methodologies were adopted for this research, including analysis of two case studies, correlation analysis, and comparative analysis. The literature reviewed the most-used multi-criteria decision making (MCDM) methods, including subjective methods and objective methods. The advantages and disadvantages of each MCDM method were briefly discussed. One more round literature review was conducted to search publications between 2017 and 2019 in CNKI. Followed two case studies, correlation analysis and comparative analysis were then conducted. Research ethics was approved by the Shanxi Coking Coal Group Research Committee. Results The literature searched a total of 25,831publications and found that the PCA method was the predominant method adopted, and the Entropy method was the second most widely adopted method. Two weighting methods were compared using two case studies. For the comparative analysis of Case Study 1, the PCA method appeared to be more responsive than the Entropy. For Case Study 2, the Entropy method is more responsive than the PCA. As a result, both methods were adopted for different cases in the case study mine and finally deployed for user acceptance testing on 5 November 2020. Conclusions The findings and suggestions were provided as further scopes for further research. This research indicated that no single method could be adopted as the better option for establishing indexing measurement in all cases. The practical implication suggests that comparative analysis should always be conducted on each case and determine the appropriate weighting method to the relevant case. This research recommended that the PCA method was a dimension reduction technique that could be handy for identifying the critical variables or factors and effectively used in hazard, risk, and emergency assessment. The PCA method might also be well-applied for developing predicting and forecasting systems as it was sensitive to outliers. The Entropy method might be suitable for all the cases requiring the MCDM. There is also a need to conduct further research to probe the causal reasons why the PCA and Entropy methods were applied to each case and not the other way round. This research found that the Entropy method provides higher accuracy than the PCA method. This research also found that the Entropy method demonstrated to assess the weights of the higher dimension dataset was higher sensitivity than the lower dimensions. Finally, the comprehensive analysis indicates a need to explore a more responsive method for establishing a weighted indexing measurement for warning applications in hazard, risk, and emergency assessments.

show abstract

“…Z-score is one of the most significant standardization procedures that may be carried out by subtracting the mean and dividing the standard deviation for each value of each feature [ 48 ]. Equation ( 2 ) shows the z -score calculation where the

is the mean and

is the SD of given continuous feature.…”

Section: Methodsmentioning

confidence: 99%

Cardiac Diagnostic Feature and Demographic Identification (CDF-DI): An IoT Enabled Healthcare Framework Using Machine Learning

Kumar

Verma

Dahiya

et al. 2021

Sensors

View full text Add to dashboard Cite

The incidence of cardiovascular diseases and cardiovascular burden (the number of deaths) are continuously rising worldwide. Heart disease leads to heart failure (HF) in affected patients. Therefore any additional aid to current medical support systems is crucial for the clinician to forecast the survival status for these patients. The collaborative use of machine learning and IoT devices has become very important in today’s intelligent healthcare systems. This paper presents a Public Key Infrastructure (PKI) secured IoT enabled framework entitled Cardiac Diagnostic Feature and Demographic Identification (CDF-DI) systems with significant Models that recognize several Cardiac disease features related to HF. To achieve this goal, we used statistical and machine learning techniques to analyze the Cardiac secondary dataset. The Elevated Serum Creatinine (SC) levels and Serum Sodium (SS) could cause renal problems and are well established in HF patients. The Mann Whitney U test found that SC and SS levels affected the survival status of patients (p < 0.05). Anemia, diabetes, and BP features had no significant impact on the SS and SC level in the patient (p > 0.05). The Cox regression model also found a significant association of age group with the survival status using follow-up months. Furthermore, the present study also proposed important features of Cardiac disease that identified the patient’s survival status, age group, and gender. The most prominent algorithm was the Random Forest (RF) suggesting five key features to determine the survival status of the patient with an accuracy of 96%: Follow-up months, SC, Ejection Fraction (EF), Creatinine Phosphokinase (CPK), and platelets. Additionally, the RF selected five prominent features (smoking habits, CPK, platelets, follow-up month, and SC) in recognition of gender with an accuracy of 94%. Moreover, the five vital features such as CPK, SC, follow-up month, platelets, and EF were found to be significant predictors for the patient’s age group with an accuracy of 96%. The Kaplan Meier plot revealed that mortality was high in the extremely old age group (χ2 (1) = 8.565). The recommended features have possible effects on clinical practice and would be supportive aid to the existing medical support system to identify the possibility of the survival status of the heart patient. The doctor should primarily concentrate on the follow-up month, SC, EF, CPK, and platelet count for the patient’s survival in the situation.

show abstract

An IoT-Focused Intrusion Detection System Approach Based on Preprocessing Characterization for Cybersecurity Datasets

Cited by 68 publications

References 33 publications

UGRansome1819: A Novel Dataset for Anomaly Detection and Zero-Day Threats

UGRansome1819: A Novel Dataset for Anomaly Detection and Zero-Day Threats

A comparative analysis of the principal component analysis and entropy weight methods to establish the indexing measurement

Cardiac Diagnostic Feature and Demographic Identification (CDF-DI): An IoT Enabled Healthcare Framework Using Machine Learning

Contact Info

Product

Resources

About