Predicting Network Attacks with CNN by Constructing Images from NetFlow Data

Liu, Xiang; Tang, Ziyang; Yang, Baijian

doi:10.1109/bigdatasecurity-hpsc-ids.2019.00022

Cited by 28 publications

(23 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An interesting approach, which maps the NetFlow data to the image representation, has been presented in [13]. In order to construct the images, the authors have used such techniques as feature correlation analysis and correlation matrices.…”

Section: Related Workmentioning

confidence: 99%

A new method of hybrid time window embedding with transformer-based traffic data classification in IoT-networked environment

Kozik

Pawlicki

Choraś

2021

Pattern Anal Applic

View full text Add to dashboard Cite

The Internet of Things (IoT) appliances often expose sensitive data, either directly or indirectly. They may, for instance, tell whether you are at home right now or what your long or short-term habits are. Therefore, it is crucial to protect such devices against adversaries and has in place an early warning system which indicates compromised devices in a quick and efficient manner. In this paper, we propose time window embedding solutions that efficiently process a massive amount of data and have a low-memory-footprint at the same time. On top of the proposed embedding vectors, we use the core anomaly detection unit. It is a classifier that is based on the transformer’s encoder component followed by a feed-forward neural network. We have compared the proposed method with other classical machine-learning algorithms. Therefore, in the paper, we formally evaluate various machine-learning schemes and discuss their effectiveness in the IoT-related context. Our proposal is supported by detailed experiments that have been conducted on the recently published Aposemat IoT-23 dataset.

show abstract

Section: Related Workmentioning

confidence: 99%

A new method of hybrid time window embedding with transformer-based traffic data classification in IoT-networked environment

Kozik

Pawlicki

Choraś

2021

Pattern Anal Applic

View full text Add to dashboard Cite

show abstract

“…is classification method relies on statistical features or time series features and can handle encrypted and unencrypted traffic. ese methods usually use classic machine learning algorithms to process analysis [16].…”

Section: Related Workmentioning

confidence: 99%

“…ere are three main methods for detecting network traffic anomalies based on deep learning: deep Boltzmann machine [33,34], stacked autoencoder [35,36], and CNN [16,37]. Ertam and Avcı developed GA-WKELM software.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Classification of Abnormal Traffic in Smart Grids Based on GACNN and Data Statistical Analysis

Zhang

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

With the continuous development of smart grids, communication networks carry more and more power services, and at the same time, they are also facing more and more security issues. For example, some malicious software usually uses encryption technology or tunnel technology to bypass firewalls, intrusion detection systems, etc., thereby posing a serious threat to the information security of smart grids. At present, the classification of network traffic mainly depends on the correct extraction of network protocol characteristics. However, the process of extracting network features by some traditional methods is time-consuming and overly dependent on experience. In order to solve the problem of accurate classification of power network traffic, this paper proposes a method of convolutional neural network based on genetic algorithm optimization (GACNN) and data statistical analysis. This method can simultaneously extract the time characteristics between different packet groups and the spatial characteristics in the same packet group. Therefore, it greatly saves manpower and gets rid of the dependence on experience value. The proposed method has been tested and verified on the UNSW-NB15 dataset and the real dataset collected by the power company. The results show that the proposed method can correctly classify abnormal network flows and is much better than traditional machine learning methods. In large-scale real network flow scenarios, the detection rate of the proposed method exceeds 97%, while the traditional method is generally less than 90%.

show abstract

“…We first loaded the train, validation set. The ResNet [13] is designed to accept the images with size 224 x 224 [11] while the preprocessed images had dimension 60 x 60 x 3. So, we transformed the [13] model had 1000 output classes but, in our use case, we set output class as 1 for binary classification while for multi-class classification, we set output classes as 12.…”

Section: Attack Detectionmentioning

confidence: 99%

IoT DoS and DDoS Attack Detection using ResNet

Hussain¹,

Abbas²,

Husnain³

et al. 2020

2020 IEEE 23rd International Multitopic Conference (INMIC)

100

View full text Add to dashboard Cite

The network attacks are increasing both in frequency and intensity with the rapid growth of internet of things (IoT) devices. Recently, denial of service (DoS) and distributed denial of service (DDoS) attacks are reported as the most frequent attacks in IoT networks. The traditional security solutions like firewalls, intrusion detection systems, etc., are unable to detect the complex DoS and DDoS attacks since most of them filter the normal and attack traffic based upon the static predefined rules. However, these solutions can become reliable and effective when integrated with artificial intelligence (AI) based techniques. During the last few years, deep learning models especially convolutional neural networks achieved high significance due to their outstanding performance in the image processing field. The potential of these convolutional neural network (CNN) models can be used to efficiently detect the complex DoS and DDoS by converting the network traffic dataset into images. Therefore, in this work, we proposed a methodology to convert the network traffic data into image form and trained a stateof-the-art CNN model, i.e., ResNet over the converted data. The proposed methodology accomplished 99.99% accuracy for detecting the DoS and DDoS in case of binary classification. Furthermore, the proposed methodology achieved 87% average precision for recognizing eleven types of DoS and DDoS attack patterns which is 9% higher as compared to the state-of-the-art.

show abstract

Predicting Network Attacks with CNN by Constructing Images from NetFlow Data

Cited by 28 publications

References 27 publications

A new method of hybrid time window embedding with transformer-based traffic data classification in IoT-networked environment

A new method of hybrid time window embedding with transformer-based traffic data classification in IoT-networked environment

Classification of Abnormal Traffic in Smart Grids Based on GACNN and Data Statistical Analysis

IoT DoS and DDoS Attack Detection using ResNet

Contact Info

Product

Resources

About