Performance Comparison of Intrusion Detection Machine Learning Classifiers on Benchmark and New Datasets

Suleiman, Mohammed F.; Issac, Biju

doi:10.1109/iccta45985.2018.9499140

Cited by 15 publications

(7 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The LSTM models outperform because LSTM can capture the temporal dependency presented in sequence of packets, while MLP cannot. In addition, our LSTM models outperform the previous works[28,5,30]…”

mentioning

confidence: 67%

“…After publication of UNSW-NB15, there have been many research works to apply myriad of machine learning techniques to the dataset. Suleiman et al applied various classical machine learning algorithms such as Random Forest, K-nearest neighbor, and Support Vector Machine [28]. Among the experiments, J48 and K-NN algorithms were proposed as the most suitable models with high efficiency and accuracy.…”

Section: Network Intrusion Detection Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Network Intrusion Detection based on LSTM and Feature Embedding

Gwon,

Lee,

Keum

et al. 2019

Preprint

View full text Add to dashboard Cite

Growing number of network devices and services have led to increasing demand for protective measures as hackers launch attacks to paralyze or steal information from victim systems. Intrusion Detection System (IDS) is one of the essential elements of network perimeter security which detects the attacks by inspecting network traffic packets or operating system logs. While existing works demonstrated effectiveness of various machine learning techniques, only few of them utilized the time-series information of network traffic data. Also, categorical information has not been included in neural network based approaches. In this paper, we propose network intrusion detection models based on sequential information using long short-term memory (LSTM) network and categorical information using the embedding technique. We have experimented the models with UNSW-NB15, which is a comprehensive network traffic dataset. The experiment results confirm that the proposed method improve the performance, observing binary classification accuracy of 99.72%.

show abstract

mentioning

confidence: 67%

Section: Network Intrusion Detection Methodsmentioning

confidence: 99%

Network Intrusion Detection based on LSTM and Feature Embedding

Gwon,

Lee,

Keum

et al. 2019

Preprint

View full text Add to dashboard Cite

show abstract

“…Table 5 presents the accuracy obtained by implementing the proposed T‐SNERF algorithm. Random forest initially obtained 97.60% in Table 3, which increased by 7.46% after using CFS technique, compared to 90.14% in [80]. Also, random forest accuracy has been increased by 2.4% by implementing T‐SNE algorithm prior to the classification to achieve 100% accuracy and 0% FPR using nine features selected using CFS.…”

Section: Resultsmentioning

confidence: 99%

T‐SNERF: A novel high accuracy machine learning approach for Intrusion Detection Systems

Hammad

Hewahi

Elmedany

2021

IET Information Security

View full text Add to dashboard Cite

In the last few decades, Intrusion Detection System (IDS), in particular, machine learningbased anomaly detection, has gained importance over Signature Detection Systems (SDSs) in the novel attacks detection. Herein, a novel approach called T-Distributed Stochastic Neighbour Embedding and Random Forest Algorithm (T-SNERF) is presented for the classification of cyber-attacks. The approach consists of three different steps. First, the examination of feature correlations is provided. Second, the T-Distributed Stochastic Neighbour Embedding (T-SNE) data dimensional reduction technique is used. Third, Random Forest (RF) technique is utilised to evaluate the complications in the accuracy and False-Positive Rate (FPR). The proposed approach has been tested on various well-known datasets, namely, UNSW-NB 15, CICIDS-2017, and phishing datasets. The proposed novel approach achieved significant results compared with existing approaches, achieving 100% accuracy, and 0% FPR for the UNSW-NB15 dataset, and achieving high accuracy rates, up to 99.7878%, and 99.7044%, for CICIDS-2017 and Phishing datasets respectively. This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

show abstract

“…Suleiman and Issac [18] attempted to improve the detection performance of intrusion detection systems (IDS) using machine learning. IDS suffers from setbacks such as false positives (FP), low detection accuracy, and false negatives (FN).…”

Section: Related Workmentioning

confidence: 99%

Evolutionary Data Preprocessing to Alleviate Class Imbalance

Seo

2022

Security and Communication Networks

View full text Add to dashboard Cite

Intrusion detection technology for network attacks is developing rapidly with the development of artificial intelligence technology. Recently, machine learning-based methods that can detect new types of attacks have been developed. To improve the classification performance of the rare classes in the intrusion detection dataset, we study the efficient data preprocessing method based on machine learning. The UNSW-NB15, a well-known network intrusion detection dataset, is used in the experiments. The dataset includes 9 attack types and has severe class imbalance and overlap, so it is difficult to improve the classification performance above a certain level. To improve the classification performance by adjusting the number of instances of rare classes is needed. SMOTE techniques and genetic algorithms are used to optimize the ratio between classes in the training dataset. The computation time is reduced by creating a training dataset that samples only a few percent of the UNSW-NB15 dataset. Many new training datasets are generated based on the small training dataset according to the randomly generated SMOTE ratios. The classification experiments are conducted with these new training datasets. A new dataset is generated by combining the results of the experiments, and a regression model is generated by training the dataset. The best tuple of SMOTE ratios is searched by applying the model as a fitness function of the genetic algorithm. The D-S-1G combination exhibited the best performance among the test results. It consists of a decision tree classifier and the support vector regressor (SVR). As a result, the computation time was significantly reduced, and the optimal SMOTE ratios showed better results than the experimental results of the original UNSW-NB15 dataset. It was found that the classification result of each rare class relies heavily on the type of classifier.

show abstract

Performance Comparison of Intrusion Detection Machine Learning Classifiers on Benchmark and New Datasets

Cited by 15 publications

References 11 publications

Network Intrusion Detection based on LSTM and Feature Embedding

Network Intrusion Detection based on LSTM and Feature Embedding

T‐SNERF: A novel high accuracy machine learning approach for Intrusion Detection Systems

Evolutionary Data Preprocessing to Alleviate Class Imbalance

Contact Info

Product

Resources

About