Comparative Study of Supervised Machine Learning Techniques for Intrusion Detection

Gharibian, Farnaz; Ghorbani, Ali A.

doi:10.1109/cnsr.2007.22

Cited by 54 publications

(29 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The Random Forest algorithm is an ensemble of unpruned decision trees which tends to be more robust to noise in the training dataset being a very stable model builder. This was reported in other works such as [11]. The target is only to compare the results of applying a data mining algorithm to the datasets in order to discover the differences among the subsets of features.…”

Section: Methodsmentioning

confidence: 99%

“…In recent years, many data mining algorithms have been used against KDD'99 dataset in order to detect intrusion in network traffics however, many used small samples of KDD'99 dataset in their research [11,7,18,16,15,14,13]. In 2012, Zargari and Voorhis [10] found Random Forest algorithm to be producing the best detection rates against the Corrected KDD'99 dataset (includes 311027 instances) and proposed a subset of significant features using Weka.…”

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Feature selection in UNSW-NB15 and KDDCUP'99 datasets

Janarthanan

Zargari

2017

2017 IEEE 26th International Symposium on Industrial Electronics (ISIE)

134

View full text Add to dashboard Cite

Abstract-Machine learning and data mining techniques have been widely used in order to improve network intrusion detection in recent years. These techniques make it possible to automate anomaly detection in network traffics. One of the major problems that researchers are facing is the lack of published data available for research purposes. The KDD'99 dataset was used by researchers for over a decade even though this dataset was suffering from some reported shortcomings and it was criticized by few researchers. In 2009, Tavallaee M. et al. proposed a new dataset (NSL-KDD) extracted from the KDD'99 dataset in order to improve the dataset where it can be used for carrying out research in anomaly detection. The UNSW-NB15 dataset is the latest published dataset which was created in 2015 for research purposes in intrusion detection. This research is analysing the features included in the UNSW-NB15 dataset by employing machine learning techniques and exploring significant features (curse of high dimensionality) by which intrusion detection can be improved in network systems. Therefore, the existing irrelevant and redundant features are omitted from the dataset resulting not only faster training and testing process but also less resource consumption while maintaining high detection rates. A subset of features is proposed in this study and the findings are compared with the previous work in relation to features selection in the KDD'99 dataset.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%

Feature selection in UNSW-NB15 and KDDCUP'99 datasets

Janarthanan

Zargari

2017

2017 IEEE 26th International Symposium on Industrial Electronics (ISIE)

134

View full text Add to dashboard Cite

show abstract

“…Similarly, augmenting SVDDs with labeled data has been observed to greatly improve detection accuracy (Görnitz et al 2013). Other work has studied SVMs (Khan et al 2007;Li et al 2012) and other classification methods (Koc et al 2012;Peddabachigari et al 2007;Gharibian and Ghorbani 2007).…”

Section: Discussion and Related Workmentioning

confidence: 99%

Learning to control a structured-prediction decoder for detection of HTTP-layer DDoS attackers

Dick

Scheffer

2016

Mach Learn

View full text Add to dashboard Cite

We focus on the problem of detecting clients that attempt to exhaust server resources by flooding a service with protocol-compliant HTTP requests. Attacks are usually coordinated by an entity that controls many clients. Modeling the application as a structuredprediction problem allows the prediction model to jointly classify a multitude of clients based on their cohesion of otherwise inconspicuous features. Since the resulting output space is too vast to search exhaustively, we employ greedy search and techniques in which a parametric controller guides the search. We apply a known method that sequentially learns the controller and the structured-prediction model. We then derive an online policy-gradient method that finds the parameters of the controller and of the structured-prediction model in a joint optimization problem; we obtain a convergence guarantee for the latter method. We evaluate and compare the various methods based on a large collection of traffic data of a web-hosting service.

show abstract

“…The experiments showed that the approach can reduce the time to build patterns and increase the detection rate of the minority intrusions. The results showed that the proposed approach provides better performance compared to the best results from the KDD99 contest [11]. An intrusion detection system based on neural networks has been presented in [12] [13].…”

Section: Related Workmentioning

confidence: 99%

“…We also use a Naive Bayesian algorithm as a classifier for filtering malicious contents. Indeed, the Naive Bayes classifier provides a simple approach, with clear semantics, for representing, using and learning probabilistic knowledge [11]. The goal is to accurately predict the class of test instances where the training instances include the class information.…”

Section: The Machine Learning Schemementioning

confidence: 99%

Efficient training data extraction framework for intrusion detection systems

Makiou

Serhrouchni

2015

2015 6th International Conference on the Network of the Future (NOF)

View full text Add to dashboard Cite

Abstract-One of the most important challenges in networks of future is how to provide security services in an efficient and quick manner without questioning the conceptual model of these networks. NIDS (Network Intrusion Detection system) is an effective approach for dealing with these security issues. Their detection engines use two main approaches to inspect malicious traffic; misuse detection and anomaly detection. Machine learning approaches have been widely investigated in anomaly detection systems. However, despite multiple academic researches, such systems are rarely employed in operational settings. They suffer from long time training, lack of good quality training data and a random selection of features (training attributes). This paper aims to resolve issues of limited quantity and quality of training data sets and investigates the impact of features selection process on the classification performance. It introduces a novel framework to extract efficient real "ground-truth" training data sets from the network traffic for supervised machine learning algorithms. We support this claim by performing the evaluation of results on a Naive Bayesian classifier.

show abstract

Comparative Study of Supervised Machine Learning Techniques for Intrusion Detection

Cited by 54 publications

References 3 publications

Feature selection in UNSW-NB15 and KDDCUP'99 datasets

Feature selection in UNSW-NB15 and KDDCUP'99 datasets

Learning to control a structured-prediction decoder for detection of HTTP-layer DDoS attackers

Efficient training data extraction framework for intrusion detection systems

Contact Info

Product

Resources

About