Analysis of Neural Network Training and Cost Functions Impact on the Accuracy of IDS and SIEM Systems

Hajji, Saïd El; Moukafih, Nabil; Orhanou, Ghizlane

doi:10.1007/978-3-030-16458-4_25

Cited by 8 publications

(7 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It surpasses the steepest descent as it avoids the repetitive steps and takes only -orthogonal steps. In general, conjugate gradient algorithm converges faster than basic steepest descent algorithms [26].…”

Section: Standard Optimization Methodsmentioning

confidence: 99%

Spectral proximal method for solving large scale sparse optimization

et al. 2021

View full text Add to dashboard Cite

In this paper, we propose to use spectral proximal method to solve sparse optimization problems. Sparse optimization refers to an optimization problem involving the ι0 -norm in objective or constraints. The previous research showed that the spectral gradient method is outperformed the other standard unconstrained optimization methods. This is due to spectral gradient method replaced the full rank matrix by a diagonal matrix and the memory decreased from Ο(n2) to Ο(n). Since ι0-norm term is nonconvex and non-smooth, it cannot be solved by standard optimization algorithm. We will solve the ι0 -norm problem with an underdetermined system as its constraint will be considered. Using Lagrange method, this problem is transformed into an unconstrained optimization problem. A new method called spectral proximal method is proposed, which is a combination of proximal method and spectral gradient method. The spectral proximal method is then applied to the ι0-norm unconstrained optimization problem. The programming code will be written in Python to compare the efficiency of the proposed method with some existing methods. The benchmarks of the comparison are based on number of iterations, number of functions call and the computational time. Theoretically, the proposed method requires less storage and less computational time.

show abstract

Section: Standard Optimization Methodsmentioning

confidence: 99%

Spectral proximal method for solving large scale sparse optimization

et al. 2021

View full text Add to dashboard Cite

show abstract

“…(1) One-Hot Encoding (Used Preprocessing Step) e authors in [9] investigated the impact of the cost and the training function (optimizer) on the accuracy of neural network classifiers within SIEM/IDS systems. is work evaluates 37 feedforward neural networks, where each model contains different cost and training functions.…”

Section: Related Workmentioning

confidence: 99%

“…Model Dataset Accuracy (%) El Hajji et al [9] NN with best cost and training function NSL-KDD 81.8 Javaid et al [10] Sparse autoencoder with SMR NSL-KDD 78.06 Gurung et al [11] Sparse autoencoder with LR NSL-KDD 87.2 Yin et al [12] RNN based IDS NSL-KDD 81.29 Chouhan et al [13] CBR-CNN based IDS NSL-KDD 89.41 Maddikunta et al [14] DNN with PCA-GWO Kaggle dataset 99.9 Suarez-Tangil et al [15] NN and GP --Ussath et al [16] RNN and NN -89 Chiba et al [17] NN KDD 99.62 Bhattacharya et al [18] PCA-firefly based XGBoost Kaggle dataset 99.9 Gadekallu et al [19] Naive Bayes Kaggle and CERT-In repositories 99.9…”

Section: Referencementioning

confidence: 99%

See 1 more Smart Citation

Neural Network-Based Voting System with High Capacity and Low Computation for Intrusion Detection in SIEM/IDS Systems

Moukafih

Orhanou

Hajji

2020

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

Integrating intelligence into intrusion detection tools has received much attention in the last years. The goal is to improve the detection capability within SIEM and IDS systems in order to cope with the increasing number of attacks using sophisticated and complex methods to infiltrate systems. Current SIEM and IDS systems have many processes involved, which work together to collect, analyze, detect, and send notification of failures in real time. Event normalization, for example, requires significant processing power to handle network events. So, adding heavy deep learning models will invoke additional resources for the SIEM or IDS tool. This paper presents a majority system based on reliability approach that combines simple feedforward neural networks, as weak learners, and produces high detection capability with low computation resources. The experimental results show that the model is very suitable for modeling a classification model with high accuracy and that its performance is superior to that of complex resource-intensive deep learning models.

show abstract

“…For example, the authors in (Chiba et al , 2018) studied the following parameters: the number of selected entities, the number of hidden units and layers, the activation function and the data normalization function to construct an anomaly network intrusion detection system. On the other hand, El Hajji et al (2019) evaluated the impact of the learning algorithm and the cost function on the classification accuracy of neural networks in SIEM/IDS systems. This is important, because neural networks need computational resources to train and identifying such parameters is critical, that is why some authors begun to look for different various ways to trade accuracy for speed and memory usage (Huang et al , 2017).…”

Section: Related Workmentioning

confidence: 99%

Mobile agent-based SIEM for event collection and normalization externalization

Moukafih

Orhanou

Hajji

2019

ICS

Self Cite

View full text Add to dashboard Cite

Purpose This paper aims to propose a mobile agent-based security information and event management architecture (MA-SIEM) that uses mobile agents for near real-time event collection and normalization on the source device. The externalization of the normalization process, executed by several distributed mobile agents on interconnected computers and devices, proposes a SIEM server dedicated mainly for correlation and analysis. Design/methodology/approach The architecture has been proposed in three stages. In the first step, the authors described the different aspects of the proposed approach. Then they implemented the proposed architecture and presented a new vision for the insertion of normalized data into the SIEM database. Finally, the authors performed a numerical comparison between the approach used in the proposed architecture and that of existing SIEM systems. Findings The results of the experiments showed that MA-SIEM systems are more efficient than existing SIEM systems because they leave the SIEM resources primarily dedicated to advanced correlation analysis. In addition, this paper takes into account realistic scenarios and use-cases and proposes a fully automated process for transferring normalized events in near real time to the SIEM server for further analysis using mobile agents. Originality/value The work provides new insights into the normalization security-related events using light mobile agents.

show abstract

Analysis of Neural Network Training and Cost Functions Impact on the Accuracy of IDS and SIEM Systems

Cited by 8 publications

References 25 publications

Spectral proximal method for solving large scale sparse optimization

Spectral proximal method for solving large scale sparse optimization

Neural Network-Based Voting System with High Capacity and Low Computation for Intrusion Detection in SIEM/IDS Systems

Mobile agent-based SIEM for event collection and normalization externalization

Contact Info

Product

Resources

About