CICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection

Kurniabudi, Kurniabudi; Stiawan, Deris; Darmawijoyo, Darmawijoyo; Idris, Mohammad Yazid Bin; Bamhdi, Alwi M.; Budiarto, Rahmat

doi:10.1109/access.2020.3009843

Cited by 253 publications

(107 citation statements)

References 48 publications

Supporting

Mentioning

103

Contrasting

Unclassified

Order By: Relevance

“…The algorithm was used by the authors of the CIC-IDS-2017 dataset (Sharafaldin et al, 2018), and also by Kurniabudi et al (2020). Sharafaldin et al (2018) obtained results for the weighted averages of Precision, Recall and F 1 of 0.98, 0.97, and 0.97.…”

Section: Random Forest Trees (Rft)mentioning

confidence: 99%

Study of Multi-Class Classification Algorithms’ Performance on Highly Imbalanced Network Intrusion Datasets

Bulavas¹,

Marcinkevičius²,

Rumiński³

2021

Informatica

View full text Add to dashboard Cite

This paper is devoted to the problem of class imbalance in machine learning, focusing on the intrusion detection of rare classes in computer networks. The problem of class imbalance occurs when one class heavily outnumbers examples from the other classes. In this paper, we are particularly interested in classifiers, as pattern recognition and anomaly detection could be solved as a classification problem. As still a major part of data network traffic of any organization network is benign, and malignant traffic is rare, researchers therefore have to deal with a class imbalance problem. Substantial research has been undertaken in order to identify these methods or data features that allow to accurately identify these attacks. But the usual tactic to deal with the imbalance class problem is to label all malignant traffic as one class and then solve the binary classification problem. In this paper, however, we choose not to group or to drop rare classes but instead investigate what could be done in order to achieve good multi-class classification efficiency. Rare class records were up-sampled using SMOTE method (Chawla et al., 2002) to a preset ratio targets. Experiments with the 3 network traffic datasets, namely CIC-IDS2017, CSE-CIC-IDS2018 (Sharafaldin et al., 2018) and LITNET-2020(Damasevicius et al., 2020 were performed aiming to achieve reliable recognition of rare malignant classes available in these datasets.Popular machine learning algorithms were chosen for comparison of their readiness to support rare class detection. Related algorithm hyper parameters were tuned within a wide range of values, different data feature selection methods were used and tests were executed with and without oversampling to test the multiple class problem classification performance of rare classes.Machine learning algorithms ranking based on Precision, Balanced Accuracy Score,Ḡ, and prediction error Bias and Variance decomposition, show that decision tree ensembles (Adaboost, Random Forest Trees and Gradient Boosting Classifier) performed best on the network intrusion datasets used in this research.

show abstract

Section: Random Forest Trees (Rft)mentioning

confidence: 99%

Study of Multi-Class Classification Algorithms’ Performance on Highly Imbalanced Network Intrusion Datasets

Bulavas¹,

Marcinkevičius²,

Rumiński³

2021

Informatica

View full text Add to dashboard Cite

show abstract

“…Typically, given these considerations, one performs k-fold cross validation using k = 5 or k = 10. These values have been shown empirically to yield test error rate estimates that suffer neither from excessively high bias nor from very high variance [70]. Fig.…”

Section: Figure 10 Detection Accuracy Ensemble With J48 On the Best mentioning

confidence: 87%

An Approach for Optimizing Ensemble Intrusion Detection Systems

et al. 2021

Self Cite

View full text Add to dashboard Cite

“…The IGD method is modified from information gain and combined with the concept of objective distance [17]- [18]. Information gain is known as one of the most utilized attribute selection methods to choose irrelevant attributes [30]- [31]. This method generally determines the attribute importance by measuring reductions in entropy, introduced by Shannon in 1948 [32].…”

Section: Literature Reviewmentioning

confidence: 99%

Individual Attribute Selection Using Information Gain Based Distance for Group Classification of Elderly People With Hypertension

2021

View full text Add to dashboard Cite

Attribute selection is the process of selecting relevant attributes being used in model construction to enhance model accuracy. For general medical oriented classification applications, classical attribute selection methods principally select common attributes in the dataset for all individuals. The idea of using individual attributes is proposed in this study to represent the difference among individuals for self-diagnosis. Consequently, this study proposes a new attribute selection method, called information gain based distance (IGD), for individual attribute selection, which represents an individual's health condition differently and can be used for effective classification. The proposed method combines the concept of information gain and objective distance to select individual attributes affecting classification. The IGD method is expected to provide higher classification performance than classical attribute selection methods. To assess the performance of the IGD method, classification accuracy between data with classical attribute selections and with the IGD method is compared. The case study is conducted with 971 secondary data used for group classification of elderly people with hypertension. The classification result of different classifiers was compared, including K-nearest neighbors, neural network, and naive Bayes. The comparison revealed that the classification of data with the IGD attribute selection method provided an average classification accuracy of 98.73%. In comparison, those classifications of data with classical attribute selection methods provided 62.99%, 62.99%, 62.62%, and 62.85% for information gain, Gini index, chisquared, and decision tree, respectively. The results showed that data classification with the IGD method provided higher performance than those with the classical attribute selection methods.

show abstract

CICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection

Cited by 253 publications

References 48 publications

Study of Multi-Class Classification Algorithms’ Performance on Highly Imbalanced Network Intrusion Datasets

Study of Multi-Class Classification Algorithms’ Performance on Highly Imbalanced Network Intrusion Datasets

An Approach for Optimizing Ensemble Intrusion Detection Systems

Individual Attribute Selection Using Information Gain Based Distance for Group Classification of Elderly People With Hypertension

Contact Info

Product

Resources

About