MLEsIDSs: machine learning-based ensembles for intrusion detection systems—a review

Kumar, Gulshan; Thakur, Kutub; Ayyagari, Maruthi Rohit

doi:10.1007/s11227-020-03196-z

Cited by 51 publications

(11 citation statements)

References 95 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Improving detection performance by combining independent intrusion detector systems has been suggested by some researchers, mostly in the context of anomaly-based IDS. The range of combinational techniques suggested in the literature includes voting schemes, multilayer schemes (e.g., using clustering techniques [30], SVM [31] or ensemble learning [32][33][34]). There are scarce works, however, that suggest the combination of several SIDS [35].…”

Section: Related Workmentioning

confidence: 99%

On the Detection Capabilities of Signature-Based Intrusion Detection Systems in the Context of Web Attacks

et al. 2022

View full text Add to dashboard Cite

Signature-based Intrusion Detection Systems (SIDS) play a crucial role within the arsenal of security components of most organizations. They can find traces of known attacks in the network traffic or host events for which patterns or signatures have been pre-established. SIDS include standard packages of detection rulesets, but only those rules suited to the operational environment should be activated for optimal performance. However, some organizations might skip this tuning process and instead activate default off-the-shelf rulesets without understanding its implications and trade-offs. In this work, we help gain insight into the consequences of using predefined rulesets in the performance of SIDS. We experimentally explore the performance of three SIDS in the context of web attacks. In particular, we gauge the detection rate obtained with predefined subsets of rules for Snort, ModSecurity and Nemesida using seven attack datasets. We also determine the precision and rate of alert generated by each detector in a real-life case using a large trace from a public webserver. Results show that the maximum detection rate achieved by the SIDS under test is insufficient to protect systems effectively and is lower than expected for known attacks. Our results also indicate that the choice of predefined settings activated on each detector strongly influences its detection capability and false alarm rate. Snort and ModSecurity scored either a very poor detection rate (activating the less-sensitive predefined ruleset) or a very poor precision (activating the full ruleset). We also found that using various SIDS for a cooperative decision can improve the precision or the detection rate, but not both. Consequently, it is necessary to reflect upon the role of these open-source SIDS with default configurations as core elements for protection in the context of web attacks. Finally, we provide an efficient method for systematically determining which rules deactivate from a ruleset to significantly reduce the false alarm rate for a target operational environment. We tested our approach using Snort’s ruleset in our real-life trace, increasing the precision from 0.015 to 1 in less than 16 h of work.

show abstract

Section: Related Workmentioning

confidence: 99%

On the Detection Capabilities of Signature-Based Intrusion Detection Systems in the Context of Web Attacks

et al. 2022

View full text Add to dashboard Cite

show abstract

“…In [ 18 ], an extensive and in-depth review of MCS-based methods was carried out in which quite a large number of ensemble learning techniques were closely and carefully examined in terms of their synthesis, variety, and dynamic updates. So far, by applying these systems, a large number of practical issues have been addressed [ 8 ], such as problems in face recognition [ 37 ], anomaly detection [ 21 , 22 ], credit scoring [ 3 ], speech recognition [ 45 , 47 ], recommender system [ 35 , 36 ], software bug prediction [ 1 , 29 ], intrusion detection [ 2 , 25 , 32 ] and remote sensing [ 14 , 27 , 31 ] as well as having been successfully used to tackle problems on changing environments [ 24 ]. In very recent years, new applications of MCSs have been explored regarding imbalanced data problems [ 6 , 16 , 19 , 43 ] and related biological datasets to handle disease detection problems such as COVID-19 diagnosis [ 10 ].…”

Section: Introductionmentioning

confidence: 99%

A novel framework based on the multi-label classification for dynamic selection of classifiers

Elmi

Eftekhari

Mehrpooya

et al. 2023

Int. J. Mach. Learn. & Cyber.

View full text Add to dashboard Cite

Multi-classifier systems (MCSs) are some kind of predictive models that classify instances by combining the output of an ensemble of classifiers given in a pool. With the aim of enhancing the performance of MCSs, dynamic selection (DS) techniques have been introduced and applied to MCSs. Dealing with each test sample classification, DS methods seek to perform the task of classifier selection so that only the most competent classifiers are selected. The principal subject regarding DS techniques is how the competence of classifiers corresponding to every new test sample classification task can be estimated. In traditional dynamic selection methods, for classifying an unknown test sample x , first, a local region of data that is similar to x is detected. Then, those classifiers that efficiently classify the data in the local region are also selected so as to perform the classification task for x . Therefore, the main effort of these methods is focused on one of the two following tasks: (i) to provide a measure for identifying a local region, or (ii) to provide a criterion for measuring the efficiency of classifiers in the local region (competence measure). This paper proposes a new version of dynamic selection techniques that does not follow the aforementioned approach. Our proposed method uses a multi-label classifier in the training phase to determine the appropriate set of classifiers directly (without applying any criterion such as a competence measure). In the generalization phase, the suggested method is employed efficiently so as to predict the appropriate set of classifiers for classifying the test sample x . It is remarkable that the suggested multi-label-based framework is the first method that uses multi-label classification concepts for dynamic classifier selection. Unlike the existing meta-learning methods for dynamic ensemble selection in the literature, our proposed method is very simple to implement and does not need meta-features. As the experimental results indicate, the suggested technique produces a good performance in terms of both classification accuracy and simplicity which is fairly comparable with that of the benchmark DS techniques. The results of conducting the Quade non-parametric statistical test corroborate the clear dominance of the proposed method over the other benchmark methods.

show abstract

“…The Particle Swarm Optimization PSO algorithm is one of the most popular metaheuristic algorithms suitable for feature selection in this field [18]. That is because the PSO finds the optimal subset features faster than the other algorithms.…”

Section: Introductionmentioning

confidence: 99%

Feature Selection of The Anomaly Network Intrusion Detection Based on Restoration Particle Swarm Optimization

2022

IJIES

View full text Add to dashboard Cite

Intrusion detection systems are vital for detecting networking attacks due to their ability to analyze network data and find different types of attacks. The high-dimensional internet data leads to feature selection becoming a fundamental process in network intrusion detection systems. The current approaches are insufficient to determine the most effective features in the network data due to the nature of intrusion attacks appearance compared to the normal data. Moreover, the wrapper feature selection methods suffer from the search time complexity such as the standard PSO algorithm for feature selection. The standard Particle Swarms Optimization (PSO) algorithm suffers from the stagnation effect in local optima. This paper proposes a new wrapper feature selection model called Restoration Particle Swarms Optimization (RPSO) to select highly relevant feature data taking into consideration the limitation of the premature convergence between the particles which results in a stagnation problem during the iteration for the optimal features. Moreover, we utilize the randomness value to overcome the stagnation problem, reduce data volume and decrease the processing time. The Random Forest algorithm uses to classify the feature selected with our solution. As a result, we consider the NSL-KDD benchmark dataset to evaluate the proposed solution. The experiments show that the performance evaluation achieves high results in general accuracy (85%) compared to standard PSO up to 83.86%. Additionally, the results show that the proposed solution increased the detecting rate of low distributing classes in the training data up to (521 classes) compared with standard PSO by (79 classes).

show abstract

MLEsIDSs: machine learning-based ensembles for intrusion detection systems—a review

Cited by 51 publications

References 95 publications

On the Detection Capabilities of Signature-Based Intrusion Detection Systems in the Context of Web Attacks

On the Detection Capabilities of Signature-Based Intrusion Detection Systems in the Context of Web Attacks

A novel framework based on the multi-label classification for dynamic selection of classifiers

Feature Selection of The Anomaly Network Intrusion Detection Based on Restoration Particle Swarm Optimization

Contact Info

Product

Resources

About