Hybrid Model for Improving the Classification Effectiveness of Network Intrusion Detection

Dutta, Vibekananda; Choraś, Michał; Kozik, Rafał; Pawlicki, Marek

doi:10.1007/978-3-030-57805-3_38

Cited by 31 publications

(13 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, LSTM model is considered to be slow in attack detection due to sequential computation such a model utilized in several layers. Dutta et al [28] proposed a hybrid detection model for network intrusion detection system. The proposed work utilized a Classical Auto Encoder (CAE) technique along with a Deep Neural Network (DNN) model.…”

Section: Related Workmentioning

confidence: 99%

Anomaly Detection for Internet of Things Cyberattacks

Alanazi¹,

Aljuhani²

2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

The Internet of Things (IoT) has been deployed in diverse critical sectors with the aim of improving quality of service and facilitating human lives. The IoT revolution has redefined digital services in different domains by improving efficiency, productivity, and cost-effectiveness. Many service providers have adapted IoT systems or plan to integrate them as integral parts of their systems' operation; however, IoT security issues remain a significant challenge. To minimize the risk of cyberattacks on IoT networks, anomaly detection based on machine learning can be an effective security solution to overcome a wide range of IoT cyberattacks. Although various detection techniques have been proposed in the literature, existing detection methods address limited cyberattacks and utilize outdated datasets for evaluations. In this paper, we propose an intelligent, effective, and lightweight detection approach to detect several IoT attacks. Our proposed model includes a collaborative feature selection method that selects the best distinctive features and eliminates unnecessary features to build an effective and efficient detection model. In the detection phase, we also proposed an ensemble of learning techniques to improve classification for predicting several different types of IoT attacks. The experimental results show that our proposed method can effectively and efficiently predict several IoT attacks with a higher accuracy rate of 99.984%, a precision rate of 99.982%, a recall rate of 99.984%, and an F1-score of 99.983%.

show abstract

Section: Related Workmentioning

confidence: 99%

Anomaly Detection for Internet of Things Cyberattacks

Alanazi¹,

Aljuhani²

2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…Dutta et al [42] introduced a hybrid model for improving the classification metrics in a NIDS. The literature applies a deep neural network for enhancing classification accuracy.…”

Section: Related Workmentioning

confidence: 99%

Design and Development of an Efficient Network Intrusion Detection System Using Machine Learning Techniques

Gupta

2021

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

Today’s internets are made up of nearly half a million different networks. In any network connection, identifying the attacks by their types is a difficult task as different attacks may have various connections, and their number may vary from a few to hundreds of network connections. To solve this problem, a novel hybrid network IDS called NID-Shield is proposed in the manuscript that classifies the dataset according to different attack types. Furthermore, the attack names found in attack types are classified individually helping considerably in predicting the vulnerability of individual attacks in various networks. The hybrid NID-Shield NIDS applies the efficient feature subset selection technique called CAPPER and distinct machine learning methods. The UNSW-NB15 and NSL-KDD datasets are utilized for the evaluation of metrics. Machine learning algorithms are applied for training the reduced accurate and highly merit feature subsets obtained from CAPPER and then assessed by the cross-validation method for the reduced attributes. Various performance metrics show that the hybrid NID-Shield NIDS applied with the CAPPER approach achieves a good accuracy rate and low FPR on the UNSW-NB15 and NSL-KDD datasets and shows good performance results when analyzed with various approaches found in existing literature studies.

show abstract

“…Classification algorithms such as logistic regression, k-nearest neighbor algorithm, decision tree, and support vector machine are commonly used. More recently, several hybrid classification models were proposed [3][4][5]. However, in most cases, labeling data manually is highly time-consuming and inefficient.…”

Section: Network Anomaly Traffic Detection Approachesmentioning

confidence: 99%

“…Characterization of network anomaly traffic is one of the key technologies commonly used to model and detect network anomalies and then to raise the cybersecurity awareness capability of network administrators. e existing approaches of network anomaly detection can be mainly classified into six categories [1]: classification-based methods [2][3][4], clustering-based methods [5][6][7][8][9], statistical methods [10,11], stochastic methods [12,13], deep-learning-based methods [14][15][16][17], and others [18][19][20][21].…”

Section: Introductionmentioning

confidence: 99%

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy

Zhou

Xiao

Yang

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

The prosperity of mobile networks and social networks brings revolutionary conveniences to our daily lives. However, due to the complexity and fragility of the network environment, network attacks are becoming more and more serious. Characterization of network traffic is commonly used to model and detect network anomalies and finally to raise the cybersecurity awareness capability of network administrators. As a tool to characterize system running status, entropy-based time-series complexity measurement methods such as Multiscale Entropy (MSE), Composite Multiscale Entropy (CMSE), and Fuzzy Approximate Entropy (FuzzyEn) have been widely used in anomaly detection. However, the existing methods calculate the distance between vectors solely using the two most different elements of the two vectors. Furthermore, the similarity of vectors is calculated using the Heaviside function, which has a problem of bouncing between 0 and 1. The Euclidean Distance-Based Multiscale Fuzzy Entropy (EDM-Fuzzy) algorithm was proposed to avoid the two disadvantages and to measure entropy values of system signals more precisely, accurately, and stably. In this paper, the EDM-Fuzzy is applied to analyze the characteristics of abnormal network traffic such as botnet network traffic and Distributed Denial of Service (DDoS) attack traffic. The experimental analysis shows that the EDM-Fuzzy entropy technology is able to characterize the differences between normal traffic and abnormal traffic. The EDM-Fuzzy entropy characteristics of ARP traffic discovered in this paper can be used to detect various types of network traffic anomalies including botnet and DDoS attacks.

show abstract

Hybrid Model for Improving the Classification Effectiveness of Network Intrusion Detection

Cited by 31 publications

References 16 publications

Anomaly Detection for Internet of Things Cyberattacks

Anomaly Detection for Internet of Things Cyberattacks

Design and Development of an Efficient Network Intrusion Detection System Using Machine Learning Techniques

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy

Contact Info

Product

Resources

About