Deep Belief Network Integrating Improved Kernel-Based Extreme Learning Machine for Network Intrusion Detection

Wang, Zhendong; Zeng, Yong; Liu, Yaodi; Li, Dahai

doi:10.1109/access.2021.3051074

Cited by 92 publications

(50 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The KDDCUP99 dataset contains a large number of duplicate records that were removed in the NSL-KDD dataset [73]. UNSW-NB15 is different from other datasets such as KDDCUPP99, which has fewer features [74]. The KDDCUP99and NSL-KDD datasets do not contain a set of attack types, while the CICIDS2017 dataset contains a new IoT attack generated from real network traffic such as structured query language (SQL) injection, brute force, XSS, Botnet, web attack, and infiltration [75].…”

Section: Datasetsmentioning

confidence: 99%

See 1 more Smart Citation

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

et al. 2021

View full text Add to dashboard Cite

In many enterprises and the private sector, the Internet of Things (IoT) has spread globally. The growing number of different devices connected to the IoT and their various protocols have contributed to the increasing number of attacks, such as denial-of-service (DoS) and remote-to-local (R2L) ones. There are several approaches and techniques that can be used to construct attack detection models, such as machine learning, data mining, and statistical analysis. Nowadays, this technique is commonly used because it can provide precise analysis and results. Therefore, we decided to study the previous literature on the detection of IoT attacks and machine learning in order to understand the process of creating detection models. We also evaluated various datasets used for the models, IoT attack types, independent variables used for the models, evaluation metrics for assessment of models, and monitoring infrastructure using DevSecOps pipelines. We found 49 primary studies, and the detection models were developed using seven different types of machine learning techniques. Most primary studies used IoT device testbed datasets, and others used public datasets such as NSL-KDD and UNSW-NB15. When it comes to measuring the efficiency of models, both numerical and graphical measures are commonly used. Most IoT attacks occur at the network layer according to the literature. If the detection models applied DevSecOps pipelines in development processes for IoT devices, they were more secure. From the results of this paper, we found that machine learning techniques can detect IoT attacks, but there are a few issues in the design of detection models. We also recommend the continued use of hybrid frameworks for the improved detection of IoT attacks, advanced monitoring infrastructure configurations using methods based on software pipelines, and the use of machine learning techniques for advanced supervision and monitoring.

show abstract

Section: Datasetsmentioning

confidence: 99%

“…The UNSW-NB15 datasets, used in six primary studies, were generated by the Australian Centre's Cyber Range Lab [74]. This dataset varies from previous datasets such as NSL-KDD, which has fewer networks, more repetition, and fewer features.…”

Section: Machine Learning Techniquesmentioning

confidence: 99%

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Stochastic processes like Hidden Markov Model and Conditional Random Field were also frequently applied in detection of traffic anomaly [12,13]. Due to the success of deep-learning technologies in image processing and natural language processing, they have been intensively studied in network intrusion detection [14,15], network traffic tracking [16], and network traffic abnormal behavior detection [17]. Besides, time-series density analysis [18], wavelet [19], principal components analysis [20], and ensemble learning technologies [21] have been extensively investigated in network anomaly detection.…”

Section: Network Anomaly Traffic Detection Approachesmentioning

confidence: 99%

“…Characterization of network anomaly traffic is one of the key technologies commonly used to model and detect network anomalies and then to raise the cybersecurity awareness capability of network administrators. e existing approaches of network anomaly detection can be mainly classified into six categories [1]: classification-based methods [2][3][4], clustering-based methods [5][6][7][8][9], statistical methods [10,11], stochastic methods [12,13], deep-learning-based methods [14][15][16][17], and others [18][19][20][21].…”

Section: Introductionmentioning

confidence: 99%

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy

Zhou

Xiao

Yang

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

The prosperity of mobile networks and social networks brings revolutionary conveniences to our daily lives. However, due to the complexity and fragility of the network environment, network attacks are becoming more and more serious. Characterization of network traffic is commonly used to model and detect network anomalies and finally to raise the cybersecurity awareness capability of network administrators. As a tool to characterize system running status, entropy-based time-series complexity measurement methods such as Multiscale Entropy (MSE), Composite Multiscale Entropy (CMSE), and Fuzzy Approximate Entropy (FuzzyEn) have been widely used in anomaly detection. However, the existing methods calculate the distance between vectors solely using the two most different elements of the two vectors. Furthermore, the similarity of vectors is calculated using the Heaviside function, which has a problem of bouncing between 0 and 1. The Euclidean Distance-Based Multiscale Fuzzy Entropy (EDM-Fuzzy) algorithm was proposed to avoid the two disadvantages and to measure entropy values of system signals more precisely, accurately, and stably. In this paper, the EDM-Fuzzy is applied to analyze the characteristics of abnormal network traffic such as botnet network traffic and Distributed Denial of Service (DDoS) attack traffic. The experimental analysis shows that the EDM-Fuzzy entropy technology is able to characterize the differences between normal traffic and abnormal traffic. The EDM-Fuzzy entropy characteristics of ARP traffic discovered in this paper can be used to detect various types of network traffic anomalies including botnet and DDoS attacks.

show abstract

“…However, different kernel functions have different characteristics, and the performances are varying in different applications. Thus, the multiple kernel extreme learning machine (MKELM) has been proposed in [31] as a combination of multiple kernel learning and ELM, and it has also been successfully applied to many applications, such as network intrusion detection [32,33] and human activity recognition [34]. Considering a strong nonlinear relationship between the fCaO content and the related variables during cement production, MKELM is adopted to build an online prediction model for fCaO content in this paper.…”

Section: Introductionmentioning

confidence: 99%

Cholesky Factorization Based Online Sequential Multiple Kernel Extreme Learning Machine Algorithm for a Cement Clinker Free Lime Content Prediction Model

2021

View full text Add to dashboard Cite

Aiming at the difficulty in real-time measuring and the long offline measurement cycle for the content of cement clinker free lime (fCaO), it is very important to build an online prediction model for fCaO content. In this work, on the basis of Cholesky factorization, the online sequential multiple kernel extreme learning machine algorithm (COS-MKELM) is proposed. The LDLT form Cholesky factorization of the matrix is introduced to avoid the large operation amount of inverse matrix calculation. In addition, the stored initial information is utilized to realize online model identification. Then, three regression datasets are used to test the performance of the COS-MKELM algorithm. Finally, an online prediction model for fCaO content is built based on COS-MKELM. Experimental results demonstrate that the fCaO content model improves the performance in terms of learning efficiency, regression accuracy, and generalization ability. In addition, the online prediction model can be corrected in real-time when the production conditions of cement clinker change.

show abstract

Deep Belief Network Integrating Improved Kernel-Based Extreme Learning Machine for Network Intrusion Detection

Cited by 92 publications

References 44 publications

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy

Cholesky Factorization Based Online Sequential Multiple Kernel Extreme Learning Machine Algorithm for a Cement Clinker Free Lime Content Prediction Model

Contact Info

Product

Resources

About