Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

Ren, Jiadong; Guo, J.; Wang, Qian; Yuan, Hongxing; Hao, Xinlong; Zhang, Qikun

doi:10.1155/2019/7130868

Cited by 90 publications

(49 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The Adaboost meta-algorithm was implemented to tackle the unbalanced data based on the actual plan, while the ABC was used for the IDS problem optimization. Incorporating both the redesigned density peak clustering algorithm (MDPCA) and the deep belief networks (DBNs) resulted in a novel fuzzy aggregation approach which was proposed in [21]. The MDPCA section of the algorithm splits the primal training dataset into numerous minor subsets based on the similarity of the training samples feature.…”

Section: Literature Reviewmentioning

confidence: 99%

The Use of Ensemble Models for Multiple Class and Binary Class Classification for Improving Intrusion Detection Systems

Iwendi

Khan

Anajemba

et al. 2020

Sensors

105

View full text Add to dashboard Cite

The pursuit to spot abnormal behaviors in and out of a network system is what led to a system known as intrusion detection systems for soft computing besides many researchers have applied machine learning around this area. Obviously, a single classifier alone in the classifications seems impossible to control network intruders. This limitation is what led us to perform dimensionality reduction by means of correlation-based feature selection approach (CFS approach) in addition to a refined ensemble model. The paper aims to improve the Intrusion Detection System (IDS) by proposing a CFS + Ensemble Classifiers (Bagging and Adaboost) which has high accuracy, high packet detection rate, and low false alarm rate. Machine Learning Ensemble Models with base classifiers (J48, Random Forest, and Reptree) were built. Binary classification, as well as Multiclass classification for KDD99 and NSLKDD datasets, was done while all the attacks were named as an anomaly and normal traffic. Class labels consisted of five major attacks, namely Denial of Service (DoS), Probe, User-to-Root (U2R), Root to Local attacks (R2L), and Normal class attacks. Results from the experiment showed that our proposed model produces 0 false alarm rate (FAR) and 99.90% detection rate (DR) for the KDD99 dataset, and 0.5% FAR and 98.60% DR for NSLKDD dataset when working with 6 and 13 selected features.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

The Use of Ensemble Models for Multiple Class and Binary Class Classification for Improving Intrusion Detection Systems

Iwendi

Khan

Anajemba

et al. 2020

Sensors

105

View full text Add to dashboard Cite

show abstract

“…Yao et al [20] adopt machine learning techniques to propose a new intrusion detection framework to overcome the imbalance of different kinds of data in network traffic and the nonidentical distribution between the training set and the test set. Ren et al [21] adopt isolation forest, genetic algorithm, and RF to design a new intrusion detection system which mainly consists of data sampling and feature selection. Vijayakumar et al [22] explore the role of machine learning to reduce the false alarm rate of wireless intrusion detection systems.…”

Section: Related Workmentioning

confidence: 99%

A Brute-Force Black-Box Method to Attack Machine Learning-Based Systems in Cybersecurity

2020

View full text Add to dashboard Cite

Machine learning algorithms are widely utilized in cybersecurity. However, recent studies show that machine learning algorithms are vulnerable to adversarial examples. This poses new threats to the security-critical applications in cybersecurity. Currently, there is still a short of study on adversarial examples in the domain of cybersecurity. In this paper, we propose a new method known as the brute-force attack method to better evaluate the robustness of the machine learning classifiers in cybersecurity against adversarial examples. The proposed method, which works in a black-box way and covers some shortages of the existing adversarial attack methods based on generative adversarial networks, is simple to implement and only needs the output of the target classifiers to generate adversarial examples. To have a comprehensive evaluation of the attack performance of the proposed method, we use our method to generate adversarial examples against the common machine learning based security systems in cybersecurity including host intrusion detection systems, Android malware detection systems, and network intrusion detection systems. We compare the attack performance of the proposed method against these security systems with that of state-of-the-art adversarial attack methods based on generative adversarial networks. The preliminary experimental results show that the proposed method, which is more efficient in computation and outperforms the state-of-the-art attack methods based on generative adversarial networks, can be used to evaluate the robustness of various machine learning based systems in cybersecurity against adversarial examples. INDEX TERMS Adversarial examples, machine learning, deep learning, intrusion detection, malware detection, neural networks, black-box method.

show abstract

“…In algorithm 1, it's worth noting that before calculating distance, the data need to be standardized. But the output dataset of this algorithm is a part of the raw dataset, not the standardized dataset as line (17). Line (1) performs 0-1 normalization.…”

Section: Data Balancing Algorithm Based On Improved Knn Outlier Detecmentioning

confidence: 99%

“…Therefore, it is necessary to construct an effective anomaly detection classifier. Based on a large number of experiments and the ability of the RF classifier in processing complex and multi-category data [17], the random forests algorithm is as the classification model in this paper.…”

Section: Introductionmentioning

confidence: 99%

A Novel Network Anomaly Detection Method based on Data Balancing and Recursive Feature Addition

2020

KSII TIIS

View full text Add to dashboard Cite

Network anomaly detection system plays an essential role in detecting network anomaly and ensuring network security. Anomaly detection system based machine learning has become an increasingly popular solution. However, due to the unbalance and high-dimension characteristics of network traffic, the existing methods unable to achieve the excellent performance of high accuracy and low false alarm rate. To address this problem, a new network anomaly detection method based on data balancing and recursive feature addition is proposed. Firstly, data balancing algorithm based on improved KNN outlier detection is designed to select part respective data on each category. Combination optimization about parameters of improved KNN outlier detection is implemented by genetic algorithm. Next, recursive feature addition algorithm based on correlation analysis is proposed to select effective features, in which a cross contingency test is utilized to analyze correlation and obtain a features subset with a strong correlation. Then, random forests model is as the classification model to detection anomaly. Finally, the proposed algorithm is evaluated on benchmark datasets KDD Cup 1999 and UNSW_NB15. The result illustrates the proposed strategies enhance accuracy and recall, and decrease the false alarm rate. Compared with other algorithms, this algorithm still achieves significant effects, especially recall in the small category.

show abstract

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

Cited by 90 publications

References 27 publications

The Use of Ensemble Models for Multiple Class and Binary Class Classification for Improving Intrusion Detection Systems

The Use of Ensemble Models for Multiple Class and Binary Class Classification for Improving Intrusion Detection Systems

A Brute-Force Black-Box Method to Attack Machine Learning-Based Systems in Cybersecurity

A Novel Network Anomaly Detection Method based on Data Balancing and Recursive Feature Addition

Contact Info

Product

Resources

About