Metaheuristic algorithms based Flow Anomaly Detector

Jadidi, Zahra; Muthukkumarasamy, Vallipuram; Sithirasenan, Elankayer

doi:10.1109/apcc.2013.6766043

Cited by 11 publications

(24 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Jadidi and Sheikhan [39] proposed a flow-based anomaly detection system using Multi-Layers Prescription (MLP) via a gravitational search algorithm. Their model achieved an accuracy of 99.40% for known and unknown attacks.…”

Section: References Security Threat Detection Methods Validation Stratmentioning

confidence: 99%

A Two-Level Flow-Based Anomalous Activity Detection System for IoT Networks

Ullah

Mahmoud

2020

Electronics

View full text Add to dashboard Cite

The significant increase of the Internet of Things (IoT) devices in smart homes and other smart infrastructure, and the recent attacks on these IoT devices, are motivating factors to secure and protect IoT networks. The primary security challenge to develop a methodology to identify a malicious activity correctly and mitigate the impact of such activity promptly. In this paper, we propose a two-level anomalous activity detection model for intrusion detection system in IoT networks. The level-1 model categorizes the network flow as normal flow or abnormal flow, while the level-2 model classifies the category or subcategory of detected malicious activity. When the network flow classified as an anomaly by the level-1 model, then the level-1 model forwards the stream to the level-2 model for further investigation to find the category or subcategory of the detected anomaly. Our proposed model constructed on flow-based features of the IoT network. Flow-based detection methodologies only inspect packet headers to classify the network traffic. Flow-based features extracted from the IoT Botnet dataset and various machine learning algorithms were investigated and tested via different cross-fold validation tests to select the best algorithm. The decision tree classifier yielded the highest predictive results for level-1, and the random forest classifier produced the highest predictive results for level-2. Our proposed model Accuracy, Precision, Recall, and F score for level-1 were measured as 99.99% and 99.90% for level-2. A two-level anomalous activity detection system for IoT networks we proposed will provide a robust framework for the development of malicious activity detection system for IoT networks. It would be of interest to researchers in academia and industry.

show abstract

Section: References Security Threat Detection Methods Validation Stratmentioning

confidence: 99%

A Two-Level Flow-Based Anomalous Activity Detection System for IoT Networks

Ullah

Mahmoud

2020

Electronics

View full text Add to dashboard Cite

show abstract

“…In the second phase, if an attack is known, multi-layer and radial basis function networks are used to classify the attack. Jadidi, Muthukkumarasamy, and Sithirasenan [20] proposed a method that was based on Multi-Layer Perceptron (MLP) in order to detect abnormal traffic in flow-based data. The interconnection weights of MLP are optimized by using Cuckoo and particle swarm optimization with a gravitational search algorithm (PSOGSA).…”

Section: Related Studiesmentioning

confidence: 99%

Anomaly-Based Intrusion Detection From Network Flow Features Using Variational Autoencoder

2020

View full text Add to dashboard Cite

The rapid increase in network traffic has recently led to the importance of flow-based intrusion detection systems processing a small amount of traffic data. Furthermore, anomaly-based methods, which can identify unknown attacks are also integrated into these systems. In this study, the focus is concentrated on the detection of anomalous network traffic (or intrusions) from flow-based data using unsupervised deep learning methods with semi-supervised learning approach. More specifically, Autoencoder and Variational Autoencoder methods were employed to identify unknown attacks using flow features. In the experiments carried out, the flow-based features extracted out of network traffic data, including typical and different types of attacks, were used. The Receiver Operating Characteristics (ROC) and the area under ROC curve, resulting from these methods were calculated and compared with One-Class Support Vector Machine. The ROC curves were examined in detail to analyze the performance of the methods in various threshold values. The experimental results show that Variational Autoencoder performs, for the most part, better than Autoencoder and One-Class Support Vector Machine.

show abstract

“…The degree of interconnection is defined by the weight w that depicts the impact of a neuron on another. A multilayer perceptron (MLP) with an optimization algorithm to detect abnormal network traffic has been developed by Reference 76. The MLP interconnection weights are optimized using the Cuckoo and particle swarm optimization with gravitational search algorithm (PSOGSA) techniques.…”

Section: Anomaly‐based Intrusion Detection Techniquesmentioning

confidence: 99%

Anomaly‐based intrusion detection systems: The requirements, methods, measurements, and datasets

Hajj

Sibai

Abdo

et al. 2021

Trans Emerging Tel Tech

View full text Add to dashboard Cite

With the Internet's unprecedented growth and nations' reliance on computer networks, new cyber‐attacks are created every day as means for achieving financial gain, imposing political agendas, and developing cyberwarfare arsenals. Network security is thus acquiring increasing attention among researchers, practitioners, network architects, policy makers, and others. To defend organizations' networks from existing, foreseen, and future threats, intrusion detection systems (IDSs) are becoming a must. Existing surveys on anomaly‐based IDS (AIDS) focus on specific components such as detection mechanisms and lack many others. In contrast to existing surveys, this article covers the full scope needed by researchers and practitioners alike when studying AIDS. The scope ranges from the intrusion detection techniques to attacks forms and passing through the relevant attack features, most‐used datasets, challenges, and potential solutions. This article provides an exhaustive review of IDSs and discusses their requirements and performance metrics in deep. It presents a taxonomy of IDSs based on four criteria: information source, detection strategy, detection mode, and architecture. Then, in‐depth analysis and a comparison of network intrusion detection approaches based on anomaly detection techniques are given. The article also introduces a classification of computer network attacks, along with their different forms and the relevant network traffic features to detect them, as well as a summary of the popular datasets used by the researchers to evaluate the IDSs. Finally, the article highlights several research challenges and the possible solutions to deal with them.

show abstract

Metaheuristic algorithms based Flow Anomaly Detector

Cited by 11 publications

References 24 publications

A Two-Level Flow-Based Anomalous Activity Detection System for IoT Networks

A Two-Level Flow-Based Anomalous Activity Detection System for IoT Networks

Anomaly-Based Intrusion Detection From Network Flow Features Using Variational Autoencoder

Anomaly‐based intrusion detection systems: The requirements, methods, measurements, and datasets

Contact Info

Product

Resources

About