UTTAMA: An Intrusion Detection System Based on Feature Clustering and Feature Transformation

Nagaraja, Arun; Batra, Uma; Kumar, Gunupudi Rajesh

doi:10.1007/s10699-019-09589-5

Cited by 24 publications

(11 citation statements)

References 54 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The present research is also inspired from the research contributions Aljawarneh et al (2019) UshaRani and Sammulal (2015) Aljawarneh, Radhakrishna, and Reddy (2018) Yelipe et al (2018) Lin, Jiang, and Lee (2014). A fuzzy measure for intrusion detection is proposed by Nagaraja, Uma, and Gunupudi (2019) which is one of the important recent contributions which has its basis on incremental clustering. Some of the anomaly detection methods based on feature selection and feature clustering includes the research contributions Nagaraja et al (2019), Aljawarneh, Aldwairi, and Yassein (2018) Narsimha, Rajesh Kumar, and Mangathayaru (2016) Aljawarneh, RadhaKrishna, and Kumar (2017) Aljawarneh and Vangipuram (2018).…”

Section: Literature Surveymentioning

confidence: 99%

A machine learning approach for imputation and anomaly detection in IoT environment

Radhakrishna

Kumar

Puligadda³

et al. 2020

Expert Systems

Self Cite

View full text Add to dashboard Cite

The problem of anomaly and attack detection in IoT environment is one of the prime challenges in the domain of internet of things that requires an immediate concern. For example, anomalies and attacks in IoT environment such as scan, malicious operation, denial of service, spying, data type probing, wrong setup, malicious control can lead to failure of an IoT system. Datasets generated in an IoT environment usually have missing values. The presence of missing values makes the classifier unsuitable for classification task. This article introduces (a) a novel imputation technique for imputation of missing data values (b) a classifier which is based on feature transformation to perform classification (c) imputation measure for similarity computation between any two instances that can also be used as similarity measure. The performance of proposed classifier is studied by using imputed datasets obtained through applying Kmeans, F-Kmeans and proposed imputation methods. Experiments are also conducted by applying existing and proposed classifiers on the imputed dataset obtained using proposed imputation technique. For experimental study in this article, we have used an open source dataset named distributed smart space orchestration system publicly available from Kaggle. Experiment results obtained are also validated using Wilcoxon non-parametric statistical test. It is proved that the performance of proposed approach is better when compared to existing classifiers when the imputation process is performed using F-Kmeans and K-Means imputation techniques. It is also observed that accuracies for attack classes scan, malicious operation, denial of service, spying, data type probing, wrong setup are 100% while it is 99% for malicious control attack class when the proposed imputation and classification technique are applied.

show abstract

Section: Literature Surveymentioning

confidence: 99%

A machine learning approach for imputation and anomaly detection in IoT environment

Radhakrishna

Kumar

Puligadda³

et al. 2020

Expert Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…Thus, the challenge in design of new intrusion detection techniques, approaches and algorithms is to essentially aim at improving the accuracies of the low frequency classes such as U2R and R2L classes in KDD dataset. Another recent contribution that has proposed an approach for anomaly detection is UTTAMA [24]. UTTAMA applied a fuzzy membership function for similarity computation and feature transformation.…”

Section: Background and Motivationmentioning

confidence: 99%

“…Conditional probability [1] can be used to derive hidden information and knowledge between features and dataset class labels. Such information may later be used to carry un-supervised learning [19], [24].…”

Section: Background and Motivationmentioning

confidence: 99%

“…For all experiments discussed in this section, the similarity threshold is set to 0.9995 and initial deviation is set to 0.5 and 10-fold cross validation is considered to evaluate the model performance. Experiments are conducted to evaluate performance of proposed approach to UTTAMA [24] and GARUDA [19]. UTTAMA [24] proposed by Arun et.al is an evolutionary feature clustering approach for network intrusion anomaly detection which uses fuzzy membership function for similarity computations.…”

Section: B Comparison With Uttama and Garudamentioning

confidence: 99%

“…The recent studies such as CANN [23], CLAPP [20], and UTTAMA [24] have applied feature reduction techniques to improve accuracy and detection rates of IDS. The distance measure applied by CANN is the Euclidean distance function.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Similarity Based Feature Transformation for Network Anomaly Detection

Nagaraja

Boregowda²,

Khatatneh

et al. 2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

The fundamental objective behind any network intrusion detection system is to automate the detection process whenever intrusions occur in the network. The problem of the network anomaly detection is to determine, if the network incoming traffic is legitimate (or) anomalous. Automated detection systems designed to identify incoming anomalous traffic patterns usually apply widely used machine learning techniques. However, irrespective of any system model which is developed to identify anomalous traffic, all these models requires comparing anomalous and normal traffic patterns. Such comparisons implicitly depend on the ability of the underlying machine learning model to gauge the similarity between a known legitimate observation and the target. The efficiency of any network anomalous detection system depends on the use of distance (or) similarity measures and how they are actually applied. A novel distance function which can be applied to determine the similarity between two conditional feature pattern vectors is an important contribution of present research. Feature dimensionality is another important issue for any machine learning algorithm. In the present work, feature reduction is achieved using the proposed feature transformation technique. However, our approach for feature transformation uses the proposed gaussian distance function to achieve dimensionality reduction to represent the original input dataset in the new transformation space. We have also proposed new computation expressions for determining equivalent deviation and threshold in gaussian space. Experiments are performed on KDD and NSL-KDD datasets by considering widely applied classifier algorithms in various state-of-art research contributions. For performance validation of machine learning models, k-fold cross validation is applied by setting k to 10 through considering evaluation parameters such as accuracy, precision and recall. Experiment results have proved that our approach for anomaly detection that applies the proposed feature transformation technique proved comparatively better to detection methods CANN, GARUDA, and UTTAMA addressed in the recent research literature.

show abstract