Nowadays,IT systems rely mainly on artificial intelligence(AI)algorithms to process data.AI is generally used to extract knowledge from stored information and,depending on the nature of data,it may be necessary to app...Nowadays,IT systems rely mainly on artificial intelligence(AI)algorithms to process data.AI is generally used to extract knowledge from stored information and,depending on the nature of data,it may be necessary to apply different AI algorithms.In this article,a novel perspective on the use of AI to ensure the cybersecurity through the study of network traffic is presented.This is done through the construction of a two-stage cyberattack classification ensemble model addressing class imbalance following a one-vs-rest(OvR)approach.With the growing trend of cyberattacks,it is essential to implement techniques that ensure legitimate access to information.To address this issue,this work proposes a network traffic classification system for different categories based on several AI techniques.In the first task,binary models are generated to clearly differentiate each type of traffic from the rest.With binary models generated,an ensemble model is developed in two phases,which allows the separation of legitimate and illegitimate traffic(phase 1)while also identifying the type of illegitimate traffic(phase 2).In this way,the proposed system allows a complete multiclass classification of network traffic.The estimation of global performance is done using a modern dataset(UNSW-NB15),evaluated using two approaches and compared with other state-of-art works.Our proposal,based on the construction of a two-step model,reaches an F1 of 0.912 for the first level of binary classification and 0.7754 for the multiclass classification.These results show that the proposed system outperforms other state-of-the-art approaches(+0.75%and+3.54%for binary and multiclass classification,respectively)in terms of F1,as demon-strated through comparison together with other relevant classification metrics.展开更多
Network Intrusion Detection System(IDS)aims to maintain computer network security by detecting several forms of attacks and unauthorized uses of applications which often can not be detected by firewalls.The features s...Network Intrusion Detection System(IDS)aims to maintain computer network security by detecting several forms of attacks and unauthorized uses of applications which often can not be detected by firewalls.The features selection approach plays an important role in constructing effective network IDS.Various bio-inspired metaheuristic algorithms used to reduce features to classify network traffic as abnormal or normal traffic within a shorter duration and showing more accuracy.Therefore,this paper aims to propose a hybrid model for network IDS based on hybridization bio-inspired metaheuristic algorithms to detect the generic attack.The proposed model has two objectives;The first one is to reduce the number of selected features for Network IDS.This objective was met through the hybridization of bioinspired metaheuristic algorithms with each other in a hybrid model.The algorithms used in this paper are particle swarm optimization(PSO),multiverse optimizer(MVO),grey wolf optimizer(GWO),moth-flame optimization(MFO),whale optimization algorithm(WOA),firefly algorithm(FFA),and bat algorithm(BAT).The second objective is to detect the generic attack using machine learning classifiers.This objective was met through employing the support vector machine(SVM),C4.5(J48)decision tree,and random forest(RF)classifiers.UNSW-NB15 dataset used for assessing the effectiveness of the proposed hybrid model.UNSW-NB15 dataset has nine attacks type.The generic attack is the highest among them.Therefore,the proposed model aims to identify generic attacks.My data showed that J48 is the best classifier compared to SVM and RF for the time needed to build the model.In terms of features reduction for the classification,my data show that the MFO-WOA and FFA-GWO models reduce the features to 15 features with close accuracy,sensitivity and F-measure of all features,whereas MVO-BAT model reduces features to 24 features with the same accuracy,sensitivity and F-measure of all features for all classifiers.展开更多
Anomaly classification based on network traffic features is an important task to monitor and detect network intrusion attacks.Network-based intrusion detection systems(NIDSs)using machine learning(ML)methods are effec...Anomaly classification based on network traffic features is an important task to monitor and detect network intrusion attacks.Network-based intrusion detection systems(NIDSs)using machine learning(ML)methods are effective tools for protecting network infrastructures and services from unpredictable and unseen attacks.Among several ML methods,random forest(RF)is a robust method that can be used in ML-based network intrusion detection solutions.However,the minimum number of instances for each split and the number of trees in the forest are two key parameters of RF that can affect classification accuracy.Therefore,optimal parameter selection is a real problem in RF-based anomaly classification of intrusion detection systems.In this paper,we propose to use the genetic algorithm(GA)for selecting the appropriate values of these two parameters,optimizing the RF classifier and improving the classification accuracy of normal and abnormal network traffics.To validate the proposed GA-based RF model,a number of experiments is conducted on two public datasets and evaluated using a set of performance evaluation measures.In these experiments,the accuracy result is compared with the accuracies of baseline ML classifiers in the recent works.Experimental results reveal that the proposed model can avert the uncertainty in selection the values of RF’s parameters,improving the accuracy of anomaly classification in NIDSs without incurring excessive time.展开更多
基金supported by the Junta de Extremadura (European Regional Development Fund),Consejería de Economía,Ciencia y Agenda Digital,under Project GR21099.
文摘Nowadays,IT systems rely mainly on artificial intelligence(AI)algorithms to process data.AI is generally used to extract knowledge from stored information and,depending on the nature of data,it may be necessary to apply different AI algorithms.In this article,a novel perspective on the use of AI to ensure the cybersecurity through the study of network traffic is presented.This is done through the construction of a two-stage cyberattack classification ensemble model addressing class imbalance following a one-vs-rest(OvR)approach.With the growing trend of cyberattacks,it is essential to implement techniques that ensure legitimate access to information.To address this issue,this work proposes a network traffic classification system for different categories based on several AI techniques.In the first task,binary models are generated to clearly differentiate each type of traffic from the rest.With binary models generated,an ensemble model is developed in two phases,which allows the separation of legitimate and illegitimate traffic(phase 1)while also identifying the type of illegitimate traffic(phase 2).In this way,the proposed system allows a complete multiclass classification of network traffic.The estimation of global performance is done using a modern dataset(UNSW-NB15),evaluated using two approaches and compared with other state-of-art works.Our proposal,based on the construction of a two-step model,reaches an F1 of 0.912 for the first level of binary classification and 0.7754 for the multiclass classification.These results show that the proposed system outperforms other state-of-the-art approaches(+0.75%and+3.54%for binary and multiclass classification,respectively)in terms of F1,as demon-strated through comparison together with other relevant classification metrics.
基金funded by The World Islamic Sciences and Education University。
文摘Network Intrusion Detection System(IDS)aims to maintain computer network security by detecting several forms of attacks and unauthorized uses of applications which often can not be detected by firewalls.The features selection approach plays an important role in constructing effective network IDS.Various bio-inspired metaheuristic algorithms used to reduce features to classify network traffic as abnormal or normal traffic within a shorter duration and showing more accuracy.Therefore,this paper aims to propose a hybrid model for network IDS based on hybridization bio-inspired metaheuristic algorithms to detect the generic attack.The proposed model has two objectives;The first one is to reduce the number of selected features for Network IDS.This objective was met through the hybridization of bioinspired metaheuristic algorithms with each other in a hybrid model.The algorithms used in this paper are particle swarm optimization(PSO),multiverse optimizer(MVO),grey wolf optimizer(GWO),moth-flame optimization(MFO),whale optimization algorithm(WOA),firefly algorithm(FFA),and bat algorithm(BAT).The second objective is to detect the generic attack using machine learning classifiers.This objective was met through employing the support vector machine(SVM),C4.5(J48)decision tree,and random forest(RF)classifiers.UNSW-NB15 dataset used for assessing the effectiveness of the proposed hybrid model.UNSW-NB15 dataset has nine attacks type.The generic attack is the highest among them.Therefore,the proposed model aims to identify generic attacks.My data showed that J48 is the best classifier compared to SVM and RF for the time needed to build the model.In terms of features reduction for the classification,my data show that the MFO-WOA and FFA-GWO models reduce the features to 15 features with close accuracy,sensitivity and F-measure of all features,whereas MVO-BAT model reduces features to 24 features with the same accuracy,sensitivity and F-measure of all features for all classifiers.
文摘Anomaly classification based on network traffic features is an important task to monitor and detect network intrusion attacks.Network-based intrusion detection systems(NIDSs)using machine learning(ML)methods are effective tools for protecting network infrastructures and services from unpredictable and unseen attacks.Among several ML methods,random forest(RF)is a robust method that can be used in ML-based network intrusion detection solutions.However,the minimum number of instances for each split and the number of trees in the forest are two key parameters of RF that can affect classification accuracy.Therefore,optimal parameter selection is a real problem in RF-based anomaly classification of intrusion detection systems.In this paper,we propose to use the genetic algorithm(GA)for selecting the appropriate values of these two parameters,optimizing the RF classifier and improving the classification accuracy of normal and abnormal network traffics.To validate the proposed GA-based RF model,a number of experiments is conducted on two public datasets and evaluated using a set of performance evaluation measures.In these experiments,the accuracy result is compared with the accuracies of baseline ML classifiers in the recent works.Experimental results reveal that the proposed model can avert the uncertainty in selection the values of RF’s parameters,improving the accuracy of anomaly classification in NIDSs without incurring excessive time.
