IDS Dataset Research Articles

An Approach for Optimizing Ensemble Intrusion Detection Systems

Intrusion Detection System is yet an interesting research topic. With a very large amount of traffic in real-time networks, feature selection techniques that are effectively able to find important and relevant features are required. Hence, the most important and relevant set of features is the key to improve the performance of intrusion detection system. This study aims to find the best relevant selected features that can be used as important features in a new IDS dataset. To achieve the aim, an approach for generating optimized ensemble IDS is developed. Six features selection methods are used and compared, i.e.: Information Gain (IG), Gain Ratio (GR), Symmetrical Uncertainty (SU), Relief-F (R-F), One-R (OR) and Chi-Square (CS). The feature selection techniques produce sets of selected features. Each best selected number of features that are obtained from feature ranking step for respective feature selection technique will be used to classify attacks via four classification methods, i.e.: Bayesian Network (BN), Naive Bayesian (NB), Decision Tree: J48 and SOM. Then, each feature selection technique with its respective best features is combined with each classifier method to generate ensemble IDSs. Lastly, the ensemble IDSs are evaluated using Hold-up, K-fold validation approaches, as well as F-Measure and statistical validation approaches. Experimental results using Weka tools on ITD-UTM dataset show the optimized ensemble IDSs using (SU and BN); using (CS and BN) or (CS and SOM) or (IG and NB); and using (OR and BN) with respective ten, four and seven best selected features achieves 81.0316%, 85.2593%, and 80.8625% of accuracy, respectively. In addition, ensemble IDSs using (SU and BN) and using (OR and J48) with ten and six best respective selected features, perform the best F-measure value, i.e.: 0.853 and 0.830, respectively. Indirect comparison with other ensemble IDS on different dataset is discussed.

Botnets Attack Detection Using Machine Learning Approach for IoT Environment

The era of the Internet of Things (IoT) is very rapidly developing with millions of devices that are useful in the smart home, smart city, and many other smart systems for education, organization and so on. On the other side, attackers are mostly targeting these devices. After infecting the malware attacks on these devices, they become bots that are controlled by attackers, and these will be targeted to the organizations not only for stealing important information but also for breaking down the network. Although some security mechanisms have developed to protect against cyber-attacks, most such systems are rule-based systems, like public IDS systems. And also, the formal rule-based detection could be circumvented by the malware attackers’ knowledge. Therefore, the machine learning-based detection scheme is the replacement for the lack of previous detection techniques. The proposed detection architecture is based on machine learning methodology, like the CART algorithm and public IDS dataset, named N-BaIoT. The experimental results indicate that the detection accuracy of the selected classifier, CART is significantly better than that of the Naïve Bayes classifier, and the overall detection rate using CART is reached up to 99%.

Unsw-Nb15 Dataset and Machine Learning Based Intrusion Detection Systems

The network attacks become the most important security problems in the today’s world. There is a high increase in use of computers, mobiles, sensors,IoTs in networks, Big Data, Web Application/Server,Clouds and other computing resources. With the high increase in network traffic, hackers and malicious users are planning new ways of network intrusions. Many techniques have been developed to detect these intrusions which are based on data mining and machine learning methods. Machine learning algorithms intend to detect anomalies using supervised and unsupervised approaches.Both the detection techniques have been implemented using IDS datasets like DARPA98, KDDCUP99, NSL-KDD, ISCX, ISOT.UNSW-NB15 is the latest dataset. This data set contains nine different modern attack types and wide varieties of real normal activities. In this paper, a detailed survey of various machine learning based techniques applied on UNSW-NB15 data set have been carried out and suggested thatUNSW-NB15 is more complex than other datasets and is assumed as a new benchmark data set for evaluating NIDSs.

Intelligent approach to build a Deep Neural Network based IDS for cloud environment using combination of machine learning algorithms

The appealing features of Cloud Computing continue to fuel its adoption and its integration in many sectors such industry, governments, education and entertainment. Nevertheless, uploading sensitive data to public cloud storage services poses security risks such as integrity, availability and confidentiality to organizations. Moreover, the open and distributed (decentralized) structure of the cloud has resulted this class of computing, prone to cyber attackers and intruders. Thereby, it is imperative to develop an anomaly network intrusion system to detect and prevent both inside and outside assaults in cloud environment with high detection precision and low false warnings. In this work, we propose an intelligent approach to build automatically an efficient and effective Deep Neural Network (DNN) based anomaly Network IDS using a hybrid optimization framework (IGASAA) based on Improved Genetic Algorithm (IGA) and Simulated Annealing Algorithm (SAA). The IDS resulted is called “MLIDS” (Machine Learning based Intrusion Detection System). Genetic Algorithm (GA) is improved through optimization strategies, namely Parallel Processing and Fitness Value Hashing, which reduce execution time, convergence time and save processing power. Moreover, SAA was incorporated to IGA with the aim to optimize its heuristic search. Our approach consists of using IGASAA in order to search the optimal or near-optimal combination of most relevant values of the parameters included in construction of DNN based IDS or impacting its performance, like feature selection, data normalization, architecture of DNN, activation function, learning rate and Momentum term, which ensure high detection rate, high accuracy and low false alarm rate. For simulation and validation of the proposed method, CloudSim 4.0 simulator platform and three benchmark IDS datasets were used, namely CICIDS2017, NSL-KDD version 2015 and CIDDS-001. The implementation results of our model demonstrate its ability to detect intrusions with high detection accuracy and low false alarm rate, and indicate its superiority in comparison with state-of-the-art methods.

Anomaly Payload Signature Generation System Based on Efficient Tokenization Methodology

Signature-based intrusion detection systems are widely used as an efficient network security control. Unfortunately, security experts manually craft attack signatures after capturing and analyzing the exploit code. Therefore, those systems are only able to detect known attacks. In this paper, we propose a new automated and content-based signature generation system that generates anomaly profiles to detect new and previously unknown attacks and worms. The proposed system, denoted SCANS, uses a natural tokenization method that speeds up the signature generation process by producing a fewer number of substrings. In this system, we propose a new stop character technique that will help to overcome signatures’ substrings granularity limitations of the old stop word techniques. In addition, SCANS introduces an improved normalized binary detection model specifically tailored for attacks detection. Experimental testing using DARPA IDS dataset shows a 95% malicious packets detection rate for port 23, with specificity of 88.4% and 94.6% for ports 21 and 25, respectively.

English

Cyber attack detection and classification is major challenge for web and network security. The increasing data traffic in network and web invites multiple cyber attack. The dynamic nature and large number of attribute of cyber data faced a problem of detection and prevention. In current research trend various method and framework are proposed by different authors. These framework and proposed method is based on data mining and neural network approach. Data mining offers various techniques such as clustering, classification, rule generation and temporal event mining; these techniques are very efficient for detection process of cyber attack. The application of neural network in cyber attack classification use as feature reduction technique. Feature reduction is very important task in cyber attack classification; because the cyber attack data consists of huge amount of features. This paper presents various method of cyber attack detection and classification technique based on data mining and neural network approach along with IDS evaluation criteria and dataset used for validated of IDS is also discussed here.

GNIDS: rule-based network intrusion detection system using genetic algorithms

Detection of intrusions in computer networks has been a growing problem motivating widespread research in computer science to develop better Intrusion Detecting Systems IDS. The existing IDS have been quite static and lack the ability to adjust themselves to the new network traffic and hence new kinds of attack. In this paper, we present a genetic algorithm GA based machine learning approach to identify such harmful/attack type of connections. The algorithm takes into consideration different features in network connections such as source and destination IP, type of protocol and status of the connection to generate a classification rule set. The proposed method is efficient with respect to good detection rate and low false positives. The experimental results demonstrate the lower execution time of the proposed algorithm. The 1999 DARPA IDS dataset is used as the evaluation dataset for both training and testing.