Incremental k-NN SVM method in intrusion detection

Xu, Binhan; Chen, Shuyu; Zhang, Hancui; Wu, Tianshu

doi:10.1109/icsess.2017.8343013

Cited by 42 publications

(16 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The fundamental function of IDSs, which calls for elevated accuracy, low false alarm rates and effectiveness to predict alarms based on positive or true alarms when intrusion occurs and false positive or false alarms in the event of a failure [8]. Those can be used to defend the systems from different kind of attacks.…”

Section: Idmentioning

confidence: 99%

See 1 more Smart Citation

Machine Learning for Cloud Security: A Systematic Review

et al. 2021

View full text Add to dashboard Cite

The popularity and usage of Cloud computing is increasing rapidly. Several companies are investing in this field either for their own use or to provide it as a service for others. One of the results of Cloud development is the emergence of various security problems for both industry and consumer. One of the ways to secure Cloud is by using Machine Learning (ML). ML techniques have been used in various ways to prevent or detect attacks and security gaps on the Cloud. In this paper, we provide a Systematic Literature Review (SLR) of ML and Cloud security methodologies and techniques. We analyzed 63 relevant studies and the results of the SLR are categorized into three main research areas: (i) the different types of Cloud security threats, (ii) ML techniques used, and (iii) the performance outcomes. We have defined 11 Cloud security areas. Moreover, distributed denial-of-service (DDoS) and data privacy are the most common Cloud security areas, with a 16% level of use and 14%respectively. On the other hand, we found 30 ML techniques used, some used hybrid and others as standalone. The most popular ML used is SVM in both hybrid and standalone models. Furthermore, 60% of the papers compared their models with other models to prove the efficiency of their proposed model. Moreover, 13 different evaluation metrics were enumerated. The most applied metric is true positive rate and least used is training time. Lastly, from 20 datasets found, KDD and KDD CUP'99 are the most used among relevant studies.

show abstract

Section: Idmentioning

confidence: 99%

“…Because Cloud infrastructure runs through standard Internet protocols and uses virtualization techniques, it may be vulnerable to attacks. Those attacks may come from traditional sources such as Address Resolution Protocol, IP spoofing, Denial of Service (DoS) etc [8], [9]. They may also come from other sources.…”

Section: Introductionmentioning

confidence: 99%

Machine Learning for Cloud Security: A Systematic Review

et al. 2021

View full text Add to dashboard Cite

show abstract

“…There are three popular methods for analyzing the network traffic to detect intrusive behaviors: statisticalbased, machine learning-based, and knowledge-based methods [3]. Among these, machine learning-based methods have received a great attention and achieved remarkable success recently [1,[4][5][6][7][8][9][10][11][12][13][14][15] even for encrypted network traffic [16,17]. To train a good detection model for IDS in the real world, a considerable number of attack and normal data samples are required to be gathered.…”

Section: Introductionmentioning

confidence: 99%

Handling Imbalanced Data in Intrusion Detection Systems using Generative Adversarial Networks

Nguyen

2020

MIC ICT Research Journal

View full text Add to dashboard Cite

Machine learning-based intrusion detection hasbecome more popular in the research community thanks to itscapability in discovering unknown attacks. To develop a gooddetection model for an intrusion detection system (IDS) usingmachine learning, a great number of attack and normal datasamples are required in the learning process. While normaldata can be relatively easy to collect, attack data is muchrarer and harder to gather. Subsequently, IDS datasets areoften dominated by normal data and machine learning modelstrained on those imbalanced datasets are ineffective in detect-ing attacks. In this paper, we propose a novel solution to thisproblem by using generative adversarial networks to generatesynthesized attack data for IDS. The synthesized attacks aremerged with the original data to form the augmented dataset.Three popular machine learning techniques are trained on theaugmented dataset. The experiments conducted on the threecommon IDS datasets and one our own dataset show thatmachine learning algorithms achieve better performance whentrained on the augmented dataset of the generative adversarialnetworks compared to those trained on the original datasetand other sampling techniques. The visualization techniquewas also used to analyze the properties of the synthesizeddata of the generative adversarial networks and the others.

show abstract

“…An incremental k-NN-SVM method is explored by Xu et al [208]. The data in batches are clustered using K-Means clustering (online aspect).…”

Section: Combination Methodsmentioning

confidence: 99%

A Framework for Anomaly Detection under Dynamic and Distributed Scenarios

Odiathevar¹

View full text Add to dashboard Cite

Anomaly Detection is an important aspect of many application domains. It refers to the problem of finding patterns in data that do not conform to expected behaviour. Hence, understanding of expected behaviour well is fundamental to performing effective anomaly detection. However, data profiles constantly evolve in certain domains such as computer networks. In other domains such as traffic monitoring and healthcare, data are distributed and are either too large or there are privacy concerns in transmitting them to a central location. These situations pose a challenge to obtain an accurate understanding of non-anomalous profiles. Changing profiles undermine existing anomaly detection models and make them less effective. Training a robust model with data from multiple sources is also challenging. Moreover, in real world scenarios, it is not apparent how an anomaly detection model can be built to address the problem. This thesis focuses on the building of a robust anomaly detection system where data profiles evolve and/or are distributed. It proposes a novel Online Offline Framework to separate existing expected behaviour, new possible expected behaviour and anomalies in streaming data. It also addresses the distributed scenario using a theoretically sound fully Bayesian approach. These methods improve performances of anomaly detection systems and work well with biased and uneven data partitions. The proposed methods are validated using real world data in three different domains. This thesis identifies the implementation difficulties in these domains and produces three novel methodologies to address each of the core anomaly detection problems.

show abstract

Incremental k-NN SVM method in intrusion detection

Cited by 42 publications

References 11 publications

Machine Learning for Cloud Security: A Systematic Review

Machine Learning for Cloud Security: A Systematic Review

Handling Imbalanced Data in Intrusion Detection Systems using Generative Adversarial Networks

A Framework for Anomaly Detection under Dynamic and Distributed Scenarios

Contact Info

Product

Resources

About