Dendron : Genetic trees driven rule induction for network intrusion detection systems

Papamartzivanos, Dimitrios; Mármol, Félix Gómez; Kambourakis, Georgios

doi:10.1016/j.future.2017.09.056

Cited by 104 publications

(55 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In detail, anomaly detection is designed to detect malicious actions through identifying deviations from a normal profile behavior. Such IDSs perform better at detecting novel types of attacks, however, they could not avoid a high false positive (FP) rate [68]. On the other hand, based on known patterns, misuse detection can effectively distinguish legitimate instances from the malicious ones [46].…”

Section: Introductionmentioning

confidence: 99%

Building an efficient intrusion detection system based on feature selection and ensemble classifier

et al. 2020

View full text Add to dashboard Cite

A B S T R A C T Intrusion detection system (IDS) is one of extensively used techniques in a network topology to safeguard the integrity and availability of sensitive assets in the protected systems. Although many supervised and unsupervised learning approaches from the field of machine learning have been used to increase the efficacy of IDSs, it is still a problem for existing intrusion detection algorithms to achieve good performance. First, lots of redundant and irrelevant data in high-dimensional datasets interfere with the classification process of an IDS. Second, an individual classifier may not perform well in the detection of each type of attacks. Third, many models are built for stale datasets, making them less adaptable for novel attacks. Thus, we propose a new intrusion detection framework in this paper, and this framework is based on the feature selection and ensemble learning techniques. In the first step, a heuristic algorithm called CFS-BA is proposed for dimensionality reduction, which selects the optimal subset based on the correlation between features. Then, we introduce an ensemble approach that combines C4.5, Random Forest (RF), and Forest by Penalizing Attributes (Forest PA) algorithms. Finally, voting technique is used to combine the probability distributions of the base learners for attack recognition. The experimental results, using NSL-KDD, AWID, and CIC-IDS2017 datasets, reveal that the proposed CFS-BA-Ensemble method is able to exhibit better performance than other related and state of the art approaches under several metrics.

show abstract

Section: Introductionmentioning

confidence: 99%

Building an efficient intrusion detection system based on feature selection and ensemble classifier

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Considering different types of attack, on average, we proposed method performs better than other considered methods. However, statistically the ranking of the proposed method is statistically undistinguishable from the methods of Zhao et al [45], Le et al [37], and Papamartzivanos et al [48]. Following the recommendation of Demšar [50], we used a series of statistical tests to compare the methods.…”

Section: Accuracymentioning

confidence: 99%

Network Intrusion Detection with a Hashing Based Apriori Algorithm Using Hadoop MapReduce

et al. 2019

View full text Add to dashboard Cite

Ubiquitous nature of Internet services across the globe has undoubtedly expanded the strategies and operational mode being used by cybercriminals to perpetrate their unlawful activities through intrusion on various networks. Network intrusion has led to many global financial loses and privacy problems for Internet users across the globe. In order to safeguard the network and to prevent Internet users from being the regular victims of cyber-criminal activities, new solutions are needed. This research proposes solution for intrusion detection by using the improved hashing-based Apriori algorithm implemented on Hadoop MapReduce framework; capable of using association rules in mining algorithm for identifying and detecting network intrusions. We used the KDD dataset to evaluate the effectiveness and reliability of the solution. Our results obtained show that this approach provides a reliable and effective means of detecting network intrusion.

show abstract

“…A hybrid deep learning-based anomaly detection scheme on software defined network [14] was proposed by Garg et al By using improved Restricted Boltzmann Machine (RBM), they reduced the dimension of the captured flow, then detected the intrusion with a gradient-based SVM. The Dendron [18] applied genetic trees driven rule induction for anomaly detection, where the decisions trees (DTs) were blended with evolutionary techniques to generate detection rules. These generated rules, which are linguistically interpretable for human comprehension, enabled the detector to take accurate decisions.…”

Section: Network Anomaly Detectionmentioning

confidence: 99%

Network Anomaly Detection by Using a Time-Decay Closed Frequent Pattern

Zhao

Chen

et al. 2019

Information

View full text Add to dashboard Cite

Anomaly detection of network traffic flows is a non-trivial problem in the field of network security due to the complexity of network traffic. However, most machine learning-based detection methods focus on network anomaly detection but ignore the user anomaly behavior detection. In real scenarios, the anomaly network behavior may harm the user interests. In this paper, we propose an anomaly detection model based on time-decay closed frequent patterns to address this problem. The model mines closed frequent patterns from the network traffic of each user and uses a time-decay factor to distinguish the weight of current and historical network traffic. Because of the dynamic nature of user network behavior, a detection model update strategy is provided in the anomaly detection framework. Additionally, the closed frequent patterns can provide interpretable explanations for anomalies. Experimental results show that the proposed method can detect user behavior anomaly, and the network anomaly detection performance achieved by the proposed method is similar to the state-of-the-art methods and significantly better than the baseline methods.

show abstract

Dendron : Genetic trees driven rule induction for network intrusion detection systems

Cited by 104 publications

References 25 publications

Building an efficient intrusion detection system based on feature selection and ensemble classifier

Building an efficient intrusion detection system based on feature selection and ensemble classifier

Network Intrusion Detection with a Hashing Based Apriori Algorithm Using Hadoop MapReduce

Network Anomaly Detection by Using a Time-Decay Closed Frequent Pattern

Contact Info

Product

Resources

About