Network intrusion detection system using J48 Decision Tree

Sahu, Shailendra; Mehtre, Babu M.

doi:10.1109/icacci.2015.7275914

Cited by 146 publications

(59 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Both algorithms are very well-known machine learning approaches and used in many classification problems. Moreover, they are suitable for large datasets which makes them optimal for network anomaly detection over cloud computing [37], [38]. We assume that each node changes its status every 500TU .…”

Section: A Simulation Environmentmentioning

confidence: 99%

TIDCS: A Dynamic Intrusion Detection and Classification System Based Feature Selection

et al. 2020

View full text Add to dashboard Cite

Machine learning techniques are becoming mainstream in intrusion detection systems as they allow real-time response and have the ability to learn and adapt. By using a comprehensive dataset with multiple attack types, a well-trained model can be created to improve the anomaly detection performance. However, high dimensional data present a significant challenge for machine learning techniques. Processing similar features that provide redundant information increases the computational time, which is a critical problem especially for users with constrained resources (battery, energy). In this paper, we propose two models for intrusion detection and classification scheme Trust-based Intrusion Detection and Classification System (TIDCS) and Trust-based Intrusion Detection and Classification System-Accelerated (TIDCS-A) for secure network. TIDCS reduces the number of features in the input data based on a new algorithm for feature selection. Initially, the features are grouped randomly to increase the probability of making them participating in the generation of different groups, and sorted based on their accuracy scores. Only the high ranked features are then selected to obtain a classification for any received packet from the nodes in the network, which is saved as part of the node's past performance. TIDCS proposes a periodic system cleansing where trust relationships between participant nodes are evaluated and renewed periodically. TIDCS-A proposes a dynamic algorithm to compute the exact time for nodes cleansing states and restricts the exposure window of the nodes. The final classification decision for both models is estimated by incorporating the node's past behavior with the machine learning algorithm. Any detected attack reduces the trustworthiness of the nodes involved, leading to a dynamic system cleansing. An evaluation of TIDCS and TIDCS-A using the NSL-KDD and UNSW datasets shows that both models can detect malicious behaviors providing higher accuracy, detection rates, and lower false alarm than state-of-art techniques. For instance, for UNSW dataset, the accuracy detection is 91% for TICDS, 83.47%by using online AODE, 88% for CADF, 90% for EDM, 90% for TANN and 69.6% for NB. Consequently, TICDS has better performance than the state of art techniques in terms of accuracy detection, while providing good detection and false alarm rates.

show abstract

Section: A Simulation Environmentmentioning

confidence: 99%

TIDCS: A Dynamic Intrusion Detection and Classification System Based Feature Selection

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Kyoto 2006+ dataset which is a new labeled network dataset was put forth by Sahu&Mehtre [1]. In this set, every instant was labeled as normal (no attack), attack (known attack) and unknown attack.…”

Section: Related Workmentioning

confidence: 99%

Optimized Ensemble Weak Learner Tree Based Network Efficient Intrusion Detection and Alert System using Data Mining

2020

IJITEE

View full text Add to dashboard Cite

The modern society accesses various network services through different devices. However, the services afford by the service provider faces various challenges and threats. The services are facing different network threats towards degrading the service performance or the entire network. Number of approaches discussed earlier to restrict the illegal access from malicious users which uses different properties in service level, packet level, user level features. However, they suffer to achieve higher performance in intrusion detection. To improve the performance in intrusion detection an novel tree based ensemble learner algorithm has been proposed in this paper. The method incorporates Random Forest and Random Trees, which are identified as NP complete. The method maintains the list of ensembles which are indexed under trees. At the classification, the Tabu Search algorithm has been used which measures the ensemble class weight (ECW) which has been used to perform classification. According to the result of intrusion detection, an alert has been generated to the administrator. The proposed algorithm improves the performance of intrusion detection.

show abstract

“…Selain itu, machine learning algorithm menggunakan akurasi untuk mengukur tingkat deteksi routing attacks di jaringan IoT. Akurasi dihitung dengan menggunakan confusion matrix seperti dalam penelitian (Sahu & Mehtre, 2015) yang ditunjukkan dalam persamaan (9) yaitu: Berdasarkan machine learning algorithm yang digunakan, hasil kinerja antara penelitian ini dengan CHA-IDS berbeda. Di dalam CHA-IDS, hasil kinerja terbaik dalam mengklasifikasikan antara serangan dan non-serangan ditunjukkan oleh J48 dengan tingkat akurasi sebesar 99,4444%, dengan nilai TP sebesar 0,994 dan nilai MAE sebesar 0,0041.…”

Section: Evaluasiunclassified

Routing Attacs pada Internet Of Things Berbasis Smart Intrution Detecion System

Sofa

Subiyanto

2020

JTIIK

View full text Add to dashboard Cite

Internet of Things (IoT) telah memasuki berbagai aspek kehidupan manusia, diantaranya smart city, smart home, smart street, dan smart industry yang memanfaatkan internet untuk memantau informasi yang dibutuhkan. Meskipun sudah dienkripsi dan diautentikasi, protokol jaringan <a title="IPv6" href="https://en.wikipedia.org/wiki/IPv6">IPv6</a> over Low-Power Wireless <a title="Personal area network" href="https://en.wikipedia.org/wiki/Personal_area_network">Personal Area Networks</a> (6LoWPAN) yang dapat menghubungkan benda-benda yang terbatas sumber daya di IoT masih belum dapat diandalkan. Hal ini dikarenakan benda-benda tersebut masih dapat terpapar oleh routing attacks yang berasal dari jaringan 6LoWPAN dan internet. Makalah ini menyajikan kinerja Smart Intrusion Detection System berdasarkan Compression Header Analyzer untuk menganalisis model routing attacks lainnya pada jaringan IoT. IDS menggunakan compression header 6LoWPAN sebagai fitur untuk machine learning algorithm dalam mempelajari jenis routing attacks. Skenario simulasi dikembangkan untuk mendeteksi routing attacks berupa selective forwarding attack dan sinkhole attack. Pengujian dilakukan menggunakan feature selection dan machine learning algorithm. Feature selection digunakan untuk menentukan fitur signifikan yang dapat membedakan antara aktivitas normal dan abnormal. Sementara machine learning algorithm digunakan untuk mengklasifikasikan routing attacks pada jaringan IoT. Ada tujuh machine learning algorithm yang digunakan dalam klasifikasi antara lain Random Forest, Random Tree, J48, Bayes Net, JRip, SMO, dan Naive Bayes. Hasil percobaan disajikan untuk menunjukkan kinerja Smart Intrusion Detection System berdasarkan Compression Header Analyzer dalam menganalisis routing attacks. Hasil evaluasi menunjukkan bahwa IDS ini dapat mendeteksi antara serangan dan non-serangan. AbstractInternet of Things (IoT) has entered various aspects of human life including smart city, smart home, smart street, and smart industries that use the internet to get the information they need. Even though it's encrypted and authenticated, Internet protocol <a title="IPv6" href="https://en.wikipedia.org/wiki/IPv6">IPv6</a> over Low-Power Wireless <a title="Personal area network" href="https://en.wikipedia.org/wiki/Personal_area_network">Personal Area Networks</a> (6LoWPAN) networks that can connect limited resources to IoT are still unreliable. This is because these objects can still be exposed to attacks from 6LoWPAN and the internet. This paper presents the performance of an Smart Intrusion Detection System based on Compression Header Analyzer to analyze other routing attack models on IoT networks. IDS uses a 6LoWPAN compression header as a feature for machine learning algorithms in learning the types of routing attacks. Simulation scenario was developed to detect routing attacks in the form of selective forwarding and sinkhole. Testing is done using the feature selection and machine learning algorithm. Feature selection is used to determine significant features that can distinguish between normal and abnormal activities. While machine learning algorithm is used to classify attacks on IoT networks. There were seven machine learning algorithms used in the classification including Random Forests, Random Trees, J48, Bayes Net, JRip, SMO, and Naive Bayes. Experiment Results to show the results of the Smart Intrusion Detection System based on Compression Header Analyzer in analyzing routing attacks. The evaluation results show that this IDS can protect between attacks and non-attacks.

show abstract

Network intrusion detection system using J48 Decision Tree

Cited by 146 publications

References 13 publications

TIDCS: A Dynamic Intrusion Detection and Classification System Based Feature Selection

TIDCS: A Dynamic Intrusion Detection and Classification System Based Feature Selection

Optimized Ensemble Weak Learner Tree Based Network Efficient Intrusion Detection and Alert System using Data Mining

Routing Attacs pada Internet Of Things Berbasis Smart Intrution Detecion System

Contact Info

Product

Resources

About