USB-IDS-1: a Public Multilayer Dataset of Labeled Network Flows for IDS Evaluation

Catillo, Marta; Vecchio, Andrea Del; Ocone, Luciano; Pecchia, Antonio; Villano, Umberto

doi:10.1109/dsn-w52860.2021.00012

Cited by 14 publications

(5 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Figure 1 illustrates the proposed approach. The USBIDS dataset [6] was used in our experimental evaluation because it provides clear feature descriptions compared to other alternative datasets. It consist of 17 csv files of labelled network flow data.…”

Section: Methodsmentioning

confidence: 99%

Explainable AI and Deep Autoencoders Based Security Framework for IoT Network Attack Certainty (Extended Abstract)

Kalutharage

Liu

Chrysoulas

2022

Attacks and Defenses for the Internet-of-Things

View full text Add to dashboard Cite

Over the past few decades, Machine Learning (ML)-based intrusion detection systems (IDS) have become increasingly popular and continue to show remarkable performance in detecting attacks. However, the lack of transparency in their decision-making process and the scarcity of attack data for training purposes pose a major challenge for the development of ML-based IDS systems for Internet of Things (IoT). Therefore, employing anomaly detection methods and interpreting predicted results in terms of feature contribution or performing featurebased impact analysis can increase stakeholders confidence. To this end, this paper presents a novel framework for IoT security monitoring, combining deep autoencoder models with Explainable Artificial Intelligence (XAI), to verify the credibility and certainty of attack detection by MLbased IDSs. Our proposed approach reduces the number of black boxes in the ML decision-making process in IoT security monitoring by explaining why a prediction is made, providing quantifiable data on which features influence the prediction and to what extent, which are generated from SHaply Adaptive values exPlanations (SHAP) linking optimal credit allocation to local explanations. This was tested using the USB-IDS benchmark dataset and a detection accuracy of 84% (benign) and 100% (attack) was achieved. Our experimental results show that integrating XAI with the autoencoder model obviates the need of malicious data for training purposes, but can provide attack certainty for detected anomalies, proving the validity of the proposed methodology.

show abstract

Section: Methodsmentioning

confidence: 99%

Explainable AI and Deep Autoencoders Based Security Framework for IoT Network Attack Certainty (Extended Abstract)

Kalutharage

Liu

Chrysoulas

2022

Attacks and Defenses for the Internet-of-Things

View full text Add to dashboard Cite

show abstract

“…There are various data sets that are widely used for academic studies and examinations on STS in the literature. In this research, we used the USB-IDS-1 dataset introduced by Catillo et al [11] in 2021. This dataset consists of 83 features and 16 classes.…”

Section: 1mentioning

confidence: 99%

“…In presented paper, we conducted a study on the USB-IDS-1 [11] dataset introduced in 2021. Section 2 provides detailed information about this data set.…”

Section: Introductionmentioning

confidence: 99%

USB-IDS-1 dataset feature reduction with genetic algorithm

Özsarı,

Aydın

et al. 2024

Communications Faculty of Sciences University of Ankara Series A2-A3 Physical Sciences and Engineering

View full text Add to dashboard Cite

Technology and online opportunities brought by technology are increasing day by day. Many transactions, from banking to shopping, can be done online. However, the abuse of technology is also increasing at the same rate. Therefore, it is very important to ensure the security of the network for data protection. The application of artificial intelligence-based approaches has also become popular in the field of information security. When the data collected for intrusion detection is examined, it is seen that there are many features. In this study, the features in the USB-IDS-1 dataset were reduced by genetic algorithm and its success was examined with various classifiers. Among the selected methods, there are decision trees, random forest, k-NN, Naive Bayes and artificial neural networks. Accuracy, sensitivity, precision and F1-score were used as metrics. According to the results obtained, it was seen that the genetic algorithm was quite successful in the Hulk and Slowloris data set, it was partially effective in the Slowhttptest data, but was not successful in the TCP set. However, the performance of the algorithms was poor as a result of using all features in Slowhttptest and TCP data.

show abstract

“…The idea of cross-evaluating ML-NIDS on different datasets is not new. For instance, the authors of [40] propose a novel IDS dataset that can be used to evaluate the 'transferability' of ML-NIDS, but they do not provide any detailed analysis nor original experiment. Similarly, Pontes et al [19] use a ML-NIDS trained on IDS18 against DDoS19.…”

Section: Related Workmentioning

confidence: 99%

The Cross-Evaluation of Machine Learning-Based Network Intrusion Detection Systems

Pajola

Conti

2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Enhancing Network Intrusion Detection Systems (NIDS) with supervised Machine Learning (ML) is tough. ML-NIDS must be trained and evaluated, operations requiring data where benign and malicious samples are clearly labelled. Such labels demand costly expert knowledge, resulting in a lack of real deployments, as well as on papers always relying on the same outdated data. The situation improved recently, as some efforts disclosed their labelled datasets. However, most past works used such datasets just as a 'yet another' testbed, overlooking the added potential provided by such availability.In contrast, we promote using such existing labelled data to cross-evaluate ML-NIDS. Such approach received only limited attention and, due to its complexity, requires a dedicated treatment. We hence propose the first cross-evaluation model. Our model highlights the broader range of realistic use-cases that can be assessed via cross-evaluations, allowing the discovery of still unknown qualities of state-of-the-art ML-NIDS. For instance, their detection surface can be extended-at no additional labelling cost. However, conducting such cross-evaluations is challenging. Hence, we propose the first framework, XeNIDS, for reliable cross-evaluations based on Network Flows. By using XeNIDS on six well-known datasets, we demonstrate the concealed potential, but also the risks, of cross-evaluations of ML-NIDS.

show abstract

USB-IDS-1: a Public Multilayer Dataset of Labeled Network Flows for IDS Evaluation

Cited by 14 publications

References 18 publications

Explainable AI and Deep Autoencoders Based Security Framework for IoT Network Attack Certainty (Extended Abstract)

Explainable AI and Deep Autoencoders Based Security Framework for IoT Network Attack Certainty (Extended Abstract)

USB-IDS-1 dataset feature reduction with genetic algorithm

The Cross-Evaluation of Machine Learning-Based Network Intrusion Detection Systems

Contact Info

Product

Resources

About