针对现有入侵检测技术的不足,文章研究了基于机器学习的异常入侵检测系统,将多标记和半监督学习应用于入侵检测,提出了一种基于多标记学习的入侵检测算法。该算法采用"k近邻"分类准则,统计近邻样本的类别标记信息,通过最大化...针对现有入侵检测技术的不足,文章研究了基于机器学习的异常入侵检测系统,将多标记和半监督学习应用于入侵检测,提出了一种基于多标记学习的入侵检测算法。该算法采用"k近邻"分类准则,统计近邻样本的类别标记信息,通过最大化后验概率(maximum a posteriori,MAP)的方式推理未标记数据的所属集合。在KDD CUP99数据集上的仿真结果表明,该算法能有效地改善入侵检测系统的性能。展开更多
Network management and multimedia data mining techniques have a great interest in analyzing and improving the network traffic process.In recent times,the most complex task in Software Defined Network(SDN)is security,w...Network management and multimedia data mining techniques have a great interest in analyzing and improving the network traffic process.In recent times,the most complex task in Software Defined Network(SDN)is security,which is based on a centralized,programmable controller.Therefore,monitoring network traffic is significant for identifying and revealing intrusion abnormalities in the SDN environment.Consequently,this paper provides an extensive analysis and investigation of the NSL-KDD dataset using five different clustering algorithms:K-means,Farthest First,Canopy,Density-based algorithm,and Exception-maximization(EM),using the Waikato Environment for Knowledge Analysis(WEKA)software to compare extensively between these five algorithms.Furthermore,this paper presents an SDN-based intrusion detection system using a deep learning(DL)model with the KDD(Knowledge Discovery in Databases)dataset.First,the utilized dataset is clustered into normal and four major attack categories via the clustering process.Then,a deep learning method is projected for building an efficient SDN-based intrusion detection system.The results provide a comprehensive analysis and a flawless reasonable study of different kinds of attacks incorporated in the KDD dataset.Similarly,the outcomes reveal that the proposed deep learning method provides efficient intrusion detection performance compared to existing techniques.For example,the proposed method achieves a detection accuracy of 94.21%for the examined dataset.展开更多
An intrusion detection system collects and analyzes information from different areas within a computer or a network to identify possible security threats that include threats from both outside as well as inside of the...An intrusion detection system collects and analyzes information from different areas within a computer or a network to identify possible security threats that include threats from both outside as well as inside of the organization. It deals with large amount of data, which contains various ir-relevant and redundant features and results in increased processing time and low detection rate. Therefore, feature selection should be treated as an indispensable pre-processing step to improve the overall system performance significantly while mining on huge datasets. In this context, in this paper, we focus on a two-step approach of feature selection based on Random Forest. The first step selects the features with higher variable importance score and guides the initialization of search process for the second step whose outputs the final feature subset for classification and in-terpretation. The effectiveness of this algorithm is demonstrated on KDD’99 intrusion detection datasets, which are based on DARPA 98 dataset, provides labeled data for researchers working in the field of intrusion detection. The important deficiency in the KDD’99 data set is the huge number of redundant records as observed earlier. Therefore, we have derived a data set RRE-KDD by eliminating redundant record from KDD’99 train and test dataset, so the classifiers and feature selection method will not be biased towards more frequent records. This RRE-KDD consists of both KDD99Train+ and KDD99Test+ dataset for training and testing purposes, respectively. The experimental results show that the Random Forest based proposed approach can select most im-portant and relevant features useful for classification, which, in turn, reduces not only the number of input features and time but also increases the classification accuracy.展开更多
Intrusion detection systems provide additional defense capacity to a networked information system in addition to the security measures provided by the firewalls. This paper proposes an active rule based enhancement to...Intrusion detection systems provide additional defense capacity to a networked information system in addition to the security measures provided by the firewalls. This paper proposes an active rule based enhancement to the C4.5 algorithm for network intrusion detection in order to detect misuse behaviors of internal attackers through effective classification and decision making in computer networks. This enhanced C4.5 algorithm derives a set of classification rules from network audit data and then the generated rules are used to detect network intrusions in a real-time environment. Unlike most existing decision tree based approaches, the spawned rules generated and fired in this work are more effective because the information-theoretic approach minimizes the expected number of tests needed to classify an object and guarantees that a simple (but not necessarily the simplest) tree is found. The main advantage of this proposed algorithm is that the generalization ability of enhanced C4.5 decision trees is better than that of C4.5 decision trees. We have employed data from the third international knowledge discovery and data mining tools competition (KDDcup’99) to train and test the feasibility of this proposed model. By applying the enhanced C4.5 algorithm an average detection rate of 93.28 percent and a false positive rate of 0.7 percent have respectively been obtained in this work.展开更多
The key objective of intrusion detection systems(IDS)is to protect the particular host or network by investigating and predicting the network traffic as an attack or normal.These IDS uses many methods of machine learn...The key objective of intrusion detection systems(IDS)is to protect the particular host or network by investigating and predicting the network traffic as an attack or normal.These IDS uses many methods of machine learning(ML)to learn from pastexperience attack i.e.signatures based and identify the new ones.Even though these methods are effective,but they have to suffer from large computational costs due to considering all the traffic features,together.Moreover,emerging technologies like the Internet of Things(Io T),big data,etc.are getting advanced day by day;as a result,network traffics are also increasing rapidly.Therefore,the issue of computational cost needs to be addressed properly.Thus,in this research,firstly,the ML methods have been used with the feature selection technique(FST)to reduce the number of features by picking out only the important ones from NSL-KDD,CICIDS2017,and CIC-DDo S2019datasets later that helped to build IDSs with lower cost but with the higher performance which would be appropriate for vast scale network.The experimental result demonstrated that the proposed model i.e.Decision tree(DT)with Recursive feature elimination(RFE)performs better than other classifiers with RFE in terms of accuracy,specificity,precision,sensitivity,F1-score,and G-means on the investigated datasets.展开更多
文摘针对现有入侵检测技术的不足,文章研究了基于机器学习的异常入侵检测系统,将多标记和半监督学习应用于入侵检测,提出了一种基于多标记学习的入侵检测算法。该算法采用"k近邻"分类准则,统计近邻样本的类别标记信息,通过最大化后验概率(maximum a posteriori,MAP)的方式推理未标记数据的所属集合。在KDD CUP99数据集上的仿真结果表明,该算法能有效地改善入侵检测系统的性能。
文摘Network management and multimedia data mining techniques have a great interest in analyzing and improving the network traffic process.In recent times,the most complex task in Software Defined Network(SDN)is security,which is based on a centralized,programmable controller.Therefore,monitoring network traffic is significant for identifying and revealing intrusion abnormalities in the SDN environment.Consequently,this paper provides an extensive analysis and investigation of the NSL-KDD dataset using five different clustering algorithms:K-means,Farthest First,Canopy,Density-based algorithm,and Exception-maximization(EM),using the Waikato Environment for Knowledge Analysis(WEKA)software to compare extensively between these five algorithms.Furthermore,this paper presents an SDN-based intrusion detection system using a deep learning(DL)model with the KDD(Knowledge Discovery in Databases)dataset.First,the utilized dataset is clustered into normal and four major attack categories via the clustering process.Then,a deep learning method is projected for building an efficient SDN-based intrusion detection system.The results provide a comprehensive analysis and a flawless reasonable study of different kinds of attacks incorporated in the KDD dataset.Similarly,the outcomes reveal that the proposed deep learning method provides efficient intrusion detection performance compared to existing techniques.For example,the proposed method achieves a detection accuracy of 94.21%for the examined dataset.
文摘An intrusion detection system collects and analyzes information from different areas within a computer or a network to identify possible security threats that include threats from both outside as well as inside of the organization. It deals with large amount of data, which contains various ir-relevant and redundant features and results in increased processing time and low detection rate. Therefore, feature selection should be treated as an indispensable pre-processing step to improve the overall system performance significantly while mining on huge datasets. In this context, in this paper, we focus on a two-step approach of feature selection based on Random Forest. The first step selects the features with higher variable importance score and guides the initialization of search process for the second step whose outputs the final feature subset for classification and in-terpretation. The effectiveness of this algorithm is demonstrated on KDD’99 intrusion detection datasets, which are based on DARPA 98 dataset, provides labeled data for researchers working in the field of intrusion detection. The important deficiency in the KDD’99 data set is the huge number of redundant records as observed earlier. Therefore, we have derived a data set RRE-KDD by eliminating redundant record from KDD’99 train and test dataset, so the classifiers and feature selection method will not be biased towards more frequent records. This RRE-KDD consists of both KDD99Train+ and KDD99Test+ dataset for training and testing purposes, respectively. The experimental results show that the Random Forest based proposed approach can select most im-portant and relevant features useful for classification, which, in turn, reduces not only the number of input features and time but also increases the classification accuracy.
文摘Intrusion detection systems provide additional defense capacity to a networked information system in addition to the security measures provided by the firewalls. This paper proposes an active rule based enhancement to the C4.5 algorithm for network intrusion detection in order to detect misuse behaviors of internal attackers through effective classification and decision making in computer networks. This enhanced C4.5 algorithm derives a set of classification rules from network audit data and then the generated rules are used to detect network intrusions in a real-time environment. Unlike most existing decision tree based approaches, the spawned rules generated and fired in this work are more effective because the information-theoretic approach minimizes the expected number of tests needed to classify an object and guarantees that a simple (but not necessarily the simplest) tree is found. The main advantage of this proposed algorithm is that the generalization ability of enhanced C4.5 decision trees is better than that of C4.5 decision trees. We have employed data from the third international knowledge discovery and data mining tools competition (KDDcup’99) to train and test the feasibility of this proposed model. By applying the enhanced C4.5 algorithm an average detection rate of 93.28 percent and a false positive rate of 0.7 percent have respectively been obtained in this work.
文摘The key objective of intrusion detection systems(IDS)is to protect the particular host or network by investigating and predicting the network traffic as an attack or normal.These IDS uses many methods of machine learning(ML)to learn from pastexperience attack i.e.signatures based and identify the new ones.Even though these methods are effective,but they have to suffer from large computational costs due to considering all the traffic features,together.Moreover,emerging technologies like the Internet of Things(Io T),big data,etc.are getting advanced day by day;as a result,network traffics are also increasing rapidly.Therefore,the issue of computational cost needs to be addressed properly.Thus,in this research,firstly,the ML methods have been used with the feature selection technique(FST)to reduce the number of features by picking out only the important ones from NSL-KDD,CICIDS2017,and CIC-DDo S2019datasets later that helped to build IDSs with lower cost but with the higher performance which would be appropriate for vast scale network.The experimental result demonstrated that the proposed model i.e.Decision tree(DT)with Recursive feature elimination(RFE)performs better than other classifiers with RFE in terms of accuracy,specificity,precision,sensitivity,F1-score,and G-means on the investigated datasets.
