SABADT: Hybrid Intrusion Detection Approach for Cyber Attacks Identification in WLAN

Abstract

With the advancement of technology, the use of wireless media and devices are increasing every day. In particular, the use of wireless local area networks (WLAN) has increased rapidly in recent years and is expected to increase further. The current state of wireless local area network technologies makes the network vulnerable to attacks ranging from passive listening to active intervention. Intrusion detection systems (IDSs) are being developed against these kinds of attacks. The IDSs play an important role in WLAN security by detecting and preventing malicious activities. However, most techniques used in IDSs cannot cope with dynamic and complex attacks. The aim of this study is to reduce the deficiencies in present IDSs for WLANs and build a more effective system which can detect unknown and complex attack variants dynamically. In this context, a methodology has been proposed. The proposed methodology basically has two contributions. The first contribution is the Feature Selection Approach (FSAP) to increase the speed of attack detection by reducing the number of used features. The second contribution is the hybrid attack detection technique, SABADT (Signature and Anomaly Based Attack Detection Technique), which detects attacks fast and with high accuracy. The proposed methodology is implemented on the KDD’99 and UNSW-NB15 datasets. The obtained results are compared with existing machine learning techniques. The detection model is created by using KDD’99, UNSW-NB15 training dataset and tested on the KDD’99 and UNSW-NB15 training dataset. The obtained 99.65% and 99.17% accuracy rates are quite high when compared to leading methods in the literature. In addition, common attack tools were used to obtain a mix of normal activities and current attack behaviors in order to test on novel attacks within the scope of the study. These different types of attacks were captured with the Wireshark tool. Some of the captured attacks were used only in the testing phase. Here, the attacks were detected with an accuracy rate of 99.69%.