Mining Techniques in Network Security to Enhance Intrusion Detection Systems

Abstract

In intrusion detection systems, classifiers still suffer from several drawbacks such as data dimensionality and dominance, different network feature types, and data impact on the classification. In this paper two significant enhancements are presented to solve these drawbacks. The first enhancement is an improved feature selection using sequential backward search and information gain. This, in turn, extracts valuable features that enhance positively the detection rate and reduce the false positive rate. The second enhancement is transferring nominal network features to numeric ones by exploiting the discrete random variable and the probability mass function to solve the problem of different feature types, the problem of data dominance, and data impact on the classification. The latter is combined to known normalization methods to achieve a significant hybrid normalization approach. Finally, an intensive and comparative study approves the efficiency of these enhancements and shows better performance comparing to other proposed methods.

Bayesian Optimization with Machine Learning Algorithms Towards Anomaly Detection

“…As most of the classifiers do not accept categorical features [24], data mapping technique was used to transform the nonnumeric values of the features into numeric ones, named categorical in MATLAB.…”

Secure Collaborative Processing Architecture for MITB Attack Detection

“…Thus, there is the urgent need to combine and correlate a large volume of data from multiple distributed sites in order to have a more comprehensive view of malicious activities that may occur and that would have gone undetected if considered in isolation. A number of research works are devoted to the study of collaborative systems for detecting massive large scale security threats [18,17,16]; however, possibly competitor distrusting organizations (e.g., different financial institutions) can be reluctant to fully adopt such collaborative approach as this imply sharing information that can be potentially sensitive. In these competitive contexts, a trusted and controllable environment should be provided, which provides specific guarantees that a number of requirements on the management of the data are continuously met.…”

Attacks Analysis of TCP And UDP Of UNCW-NB15 Dataset

“…It can be clearly seen in the figure that generic attack is a big thread for UDP. Classifiers of Intrusion Detection System still have many drawbacks [7]. Therefore it is not good to only relay on IDS.…”