Intrusion Detection System Dataset Research Articles

Temporal Weighted Averaging for Asynchronous Federated Intrusion Detection Systems.

Federated learning (FL) is an emerging subdomain of machine learning (ML) in a distributed and heterogeneous setup. It provides efficient training architecture, sufficient data, and privacy-preserving communication for boosting the performance and feasibility of ML algorithms. In this environment, the resultant global model produced by averaging various trained client models is vital. During each round of FL, model parameters are transferred from each client device to the server while the server waits for all models before it can average them. In a realistic scenario, waiting for all clients to communicate their model parameters, where client models are trained on low-power Internet of Things (IoT) devices, can result in a deadlock. In this paper, a novel temporal model averaging algorithm is proposed for asynchronous federated learning (AFL). Our approach uses a dynamic expectation function that computes the number of client models expected in each round and a weighted averaging algorithm for continuous modification of the global model. This ensures that the federated architecture is not stuck in a deadlock all the while increasing the throughput of the server and clients. To implicate the importance of asynchronicity in cybersecurity, the proposed algorithm is tested using NSL-KDD intrusion detection system datasets. The performance accuracy of the global model is about 99.5% on the dataset, outperforming traditional FL models in anomaly detection. In terms of asynchronicity, we get an increased throughput of almost 10.17% for every 30 timesteps.

Data Reduction for Optimizing Feature Selection in Modeling Intrusion Detection System

With the development and ease of access to internet networks, the potential for attacks and intrusions have increased. The intrusion detection system (IDS), an approach to overcome this problem, is grouped into two models: signature-based and anomaly-based. An anomaly-based IDS can be implemented by machine learning; one of the schemes in machine learning is data reduction. IDS datasets are usually obtained through a real-time process that has undefined proportional data. The purpose of data reduction is to speed up and optimize the process, improving accuracy, precision, and specifications. There are several methods to perform data reduction, one of which uses outlier detection techniques. Proper outlier detection has a positive impact on improving the classification results of machine learning. In this research, the outlier detection is done by a circle generated from the k -means clustering of all selected features. Two scenarios are designed for the evaluation: a circle generated from two points of the minimum and maximum cluster and median of all clusters. The formation of clusters conducted by k -means clustering determines the size and direction of the outlier circle so that it dynamically adjusts the distribution of data from the feature selection results. By employing the previous feature selection algorithms, the comparison is performed to evaluate the proposed method's performance. Our empirical results show that the second scenario can significantly improve the classification results in terms of accuracy, detection rate, and precision. The first and second experiments can increase the accuracy by 0.02%, and the third experiment is by 0.1%. The detection rate in the first, second, and third experiments increases by 0.01%, 0.02%, and 0.07. At the same time, precision increases by 0.04%, 0.02%, and 0.01%, correspondingly.

Utilising Deep Learning Techniques for Effective Zero-Day Attack Detection

Machine Learning (ML) and Deep Learning (DL) have been used for building Intrusion Detection Systems (IDS). The increase in both the number and sheer variety of new cyber-attacks poses a tremendous challenge for IDS solutions that rely on a database of historical attack signatures. Therefore, the industrial pull for robust IDSs that are capable of flagging zero-day attacks is growing. Current outlier-based zero-day detection research suffers from high false-negative rates, thus limiting their practical use and performance. This paper proposes an autoencoder implementation for detecting zero-day attacks. The aim is to build an IDS model with high recall while keeping the miss rate (false-negatives) to an acceptable minimum. Two well-known IDS datasets are used for evaluation—CICIDS2017 and NSL-KDD. In order to demonstrate the efficacy of our model, we compare its results against a One-Class Support Vector Machine (SVM). The manuscript highlights the performance of a One-Class SVM when zero-day attacks are distinctive from normal behaviour. The proposed model benefits greatly from autoencoders encoding-decoding capabilities. The results show that autoencoders are well-suited at detecting complex zero-day attacks. The results demonstrate a zero-day detection accuracy of 89–99% for the NSL-KDD dataset and 75–98% for the CICIDS2017 dataset. Finally, the paper outlines the observed trade-off between recall and fallout.

An Analysis of the KDD99 and UNSW-NB15 Datasets for the Intrusion Detection System

The significant increase in technology development over the internet makes network security a crucial issue. An intrusion detection system (IDS) shall be introduced to protect the networks from various attacks. Even with the increased amount of works in the IDS research, there is a lack of studies that analyze the available IDS datasets. Therefore, this study presents a comprehensive analysis of the relevance of the features in the KDD99 and UNSW-NB15 datasets. Three methods were employed: a rough-set theory (RST), a back-propagation neural network (BPNN), and a discrete variant of the cuttlefish algorithm (D-CFA). First, the dependency ratio between the features and the classes was calculated, using the RST. Second, each feature in the datasets became an input for the BPNN, to measure their ability for a classification task concerning each class. Third, a feature-selection process was carried out over multiple runs, to indicate the frequency of the selection of each feature. From the result, it indicated that some features in the KDD99 dataset could be used to achieve a classification accuracy above 84%. Moreover, a few features in both datasets were found to give a high contribution to increasing the classification’s performance. These features were present in a combination of features that resulted in high accuracy; the features were also frequently selected during the feature selection process. The findings of this study are anticipated to help the cybersecurity academics in creating a lightweight and accurate IDS model with a smaller number of features for the developing technologies.

Handling Imbalanced Data in Intrusion Detection Systems using Generative Adversarial Networks

Machine learning-based intrusion detection hasbecome more popular in the research community thanks to itscapability in discovering unknown attacks. To develop a gooddetection model for an intrusion detection system (IDS) usingmachine learning, a great number of attack and normal datasamples are required in the learning process. While normaldata can be relatively easy to collect, attack data is muchrarer and harder to gather. Subsequently, IDS datasets areoften dominated by normal data and machine learning modelstrained on those imbalanced datasets are ineffective in detect-ing attacks. In this paper, we propose a novel solution to thisproblem by using generative adversarial networks to generatesynthesized attack data for IDS. The synthesized attacks aremerged with the original data to form the augmented dataset.Three popular machine learning techniques are trained on theaugmented dataset. The experiments conducted on the threecommon IDS datasets and one our own dataset show thatmachine learning algorithms achieve better performance whentrained on the augmented dataset of the generative adversarialnetworks compared to those trained on the original datasetand other sampling techniques. The visualization techniquewas also used to analyze the properties of the synthesizeddata of the generative adversarial networks and the others.

Comparison of Machine Learning and Deep Learning Models for Network Intrusion Detection Systems

The development of robust anomaly-based network detection systems, which are preferred over static signal-based network intrusion, is vital for cybersecurity. The development of a flexible and dynamic security system is required to tackle the new attacks. Current intrusion detection systems (IDSs) suffer to attain both the high detection rate and low false alarm rate. To address this issue, in this paper, we propose an IDS using different machine learning (ML) and deep learning (DL) models. This paper presents a comparative analysis of different ML models and DL models on Coburg intrusion detection datasets (CIDDSs). First, we compare different ML- and DL-based models on the CIDDS dataset. Second, we propose an ensemble model that combines the best ML and DL models to achieve high-performance metrics. Finally, we benchmarked our best models with the CIC-IDS2017 dataset and compared them with state-of-the-art models. While the popular IDS datasets like KDD99 and NSL-KDD fail to represent the recent attacks and suffer from network biases, CIDDS, used in this research, encompasses labeled flow-based data in a simulated office environment with both updated attacks and normal usage. Furthermore, both accuracy and interpretability must be considered while implementing AI models. Both ML and DL models achieved an accuracy of 99% on the CIDDS dataset with a high detection rate, low false alarm rate, and relatively low training costs. Feature importance was also studied using the Classification and regression tree (CART) model. Our models performed well in 10-fold cross-validation and independent testing. CART and convolutional neural network (CNN) with embedding achieved slightly better performance on the CIC-IDS2017 dataset compared to previous models. Together, these results suggest that both ML and DL methods are robust and complementary techniques as an effective network intrusion detection system.

Distributed Denial-of-Service Prediction on IoT Framework by Learning Techniques

AbstractDistributed denial-of-service (DDoS) attacks on the Internet of Things (IoT) pose a serious threat to several web-based networks. The intruder’s ability to deal with the power of various cooperating devices to instigate an attack makes its administration even more multifaceted. This complexity can be further increased while lots of intruders attempt to overload an attack against a device. To counter and defend against modern DDoS attacks, several effective and powerful techniques have been used in the literature, such as data mining and artificial intelligence for the intrusion detection system (IDS), but they have some limitations. To overcome the existing limitations, in this study, we propose an intrusion detection mechanism that is an integration of a filter-based selection technique and a machine learning algorithm, called information gain-based intrusion detection system (IGIDS). In addition, IGIDS selects the most relevant features from the original IDS datasets that can help to distinguish typical low-speed DDoS attacks and, then, the selected features are passed on to the classifiers, i.e. support vector machine (SVM), decision tree (C4.5), naïve Bayes (NB) and multilayer perceptron (MLP) to detect attacks. The publicly available datasets as KDD Cup 99, CAIDA DDOS Attack 2007, CONFICKER worm, and UNINA traffic traces, are used for our experimental study. From the results of the simulation, it is clear that IGIDS with C4.5 acquires high detection and accuracy with a low false-positive rate.

An empirical model in intrusion detection systems using principal component analysis and deep learning models

AbstractData are a main resource of a computer system, which can be transmitted over network from source to destination. While transmitting, it faces lot of security issues such as virus, malware, infection, error, and data loss. The security issues are the attacks that have to be detected and eliminated in efficient way to guarantee the secure transmission. The attack detection rates of existing Intrusion Detection Systems (IDS) are low, because the number of unknown attacks are high when compared to the known attacks in the network. Thus, recent researchers focus more on evaluation of known attacks attributes, that will help in identification of the attacks. But the difficulty here is the nature of the IDS datasets. The difficulty in any IDS dataset is to, too many attributes, irrelevant and unstructured in nature. So analyzing such attributes leads to a time consuming process and that produces an inefficient result. This article presents a combined approach Principle Component Analysis and Deep learning (PCA‐DL) model to address above issues. The proposed PCA‐DL method has achieved the accuracy 92.6% on detecting the attacks correctly.

CNN-Based Network Intrusion Detection against Denial-of-Service Attacks

As cyberattacks become more intelligent, it is challenging to detect advanced attacks in a variety of fields including industry, national defense, and healthcare. Traditional intrusion detection systems are no longer enough to detect these advanced attacks with unexpected patterns. Attackers bypass known signatures and pretend to be normal users. Deep learning is an alternative to solving these issues. Deep Learning (DL)-based intrusion detection does not require a lot of attack signatures or the list of normal behaviors to generate detection rules. DL defines intrusion features by itself through training empirical data. We develop a DL-based intrusion model especially focusing on denial of service (DoS) attacks. For the intrusion dataset, we use KDD CUP 1999 dataset (KDD), the most widely used dataset for the evaluation of intrusion detection systems (IDS). KDD consists of four types of attack categories, such as DoS, user to root (U2R), remote to local (R2L), and probing. Numerous KDD studies have been employing machine learning and classifying the dataset into the four categories or into two categories such as attack and benign. Rather than focusing on the broad categories, we focus on various attacks belonging to same category. Unlike other categories of KDD, the DoS category has enough samples for training each attack. In addition to KDD, we use CSE-CIC-IDS2018 which is the most up-to-date IDS dataset. CSE-CIC-IDS2018 consists of more advanced DoS attacks than that of KDD. In this work, we focus on the DoS category of both datasets and develop a DL model for DoS detection. We develop our model based on a Convolutional Neural Network (CNN) and evaluate its performance through comparison with an Recurrent Neural Network (RNN). Furthermore, we suggest the optimal CNN design for the better performance through numerous experiments.

Generating realistic IoT‐based IDS dataset centred on fuzzy qualitative modelling for cyber‐physical systems

Before using any dataset in the intrusion detection system (IDS), it is crucial to acquire an accurate assessment of its efficiency. Nevertheless, the key complications presently met by the researchers are the deficiency of accessibility of any genuine assessment dataset and efficient metric for evaluating the enumerated quality of realism (QoR) of any internet of things (IoT)-based IDS dataset. It is challenging to obtain and gather data from real-world company setups owing to commercial continuousness and concerns such as integrity. This Letter presents a Sugeno fuzzy inference machine (SFIM)-based metric method for assessing the QoR of existing IoT IDS datasets. Secondly, based on the results of the proposed metric, a synthetically precise next level IoT-based IDS dataset is aimed and produced, and an initial assessment showed to support the development of forthcoming IoT-IDS. This created dataset comprises both regular and irregular replications of present IoT-based network events happening at the precarious cyber structure in different companies. Finally, the QoR of the generated dataset is evaluated by means of the proposed metric and is compared with state-of-the-art commonly available compelling datasets for validating its supremacy.

In brief

PAGE 447 Chinese researchers present a theoretical model of the degree of polymerisation of graphene pressure sensors. The theoretical model is verified with experimental results, allowing it to be used to analyse the different shapes of graphene pressure sensors. The authors hope the work will prove useful to those involved in the research of graphene pressure sensors. PAGE 459 A procedure for transport block size determination in 5G new radio is modified to reduce the difference between actual code rate and target code rate. As a result, the channel coding performance is improved and the latency of data transmission is reduced. Relationship between the number of sides, polymerisation degree and deformation displacement for the studied sensors. PAGE 431 Researchers from the Republic of Korea describe a voltage-mode PAM4 driver with differential ternary R-2R DAC. The differential ternary R-2R DAC provides three voltage levels with one R-2R branch, making it more efficient. The proposed device consumes 1.97 mW/Gbps from a 1.0 V supply at 10 Gbps. If actual code rate ≫ R, appropriate base graph is not selected. PAGE 453 A collaboration of Chinese researchers presents an effective and robust hybrid algorithm consisting of particle swarm optimisation and limited memory Broyden-Fletcher-Goldfarb-Shanno methodologies, based on an artificial neural network. The scheme is proposed for modelling flexible metal-oxide thin-film transistors. The method is validated by experimental data. Eye diagram at 3 Gbps to measure the RLM. PAGE 441 A collaboration of researchers present a Sugeno fuzzy interference machine-based metric method for assessing the quality of realism of existing internet of things intrusion detection system datasets. The quality of realism is compared with state-of-the-art commonly available datasets, validating its supremacy. Schematic diagram of a flexible IZO TFT. Design of the testbed.

An Intelligent Feature Selection with Optimal Neural Network Based Network Intrusion Detection System for Cloud Environment

At present times, Cloud Computing (CC) becomes more familiar in several domains such as education, media, industries, government, and so on. On the other hand, uploading sensitive data to public cloud storage services involves diverse security issues, specifically integrity, availability and confidentiality to organizations/companies. Besides, the open and distributed (decentralized) structure of the cloud is highly prone to cyber attackers and intruders. Therefore, it is needed to design an intrusion detection system (IDS) for cloud environment to achieve high detection rate with low false alarm rate. The proposed model involves a binary grasshopper optimization algorithm with mutation (BGOA-M) as a feature selector to choose the optimal features. For classification, improved particle swarm optimization (IPSO) based NN model, called IPSO-NN has been derived. The significance of the IPSO-NN model is assessed using a set of two benchmark IDS dataset. The experimental results stated that the IPSO-NN model has achieved maximum accuracy values of 99.36% and 97.80% on the applied NSL-KDD 2015 and CICIDS 2017 dataset. The obtained experimental outcome clearly pointed out the extraordinary detection performance of the IPSO-NN model over the compared methods.

Defense against distributed DoS attack detection by using intelligent evolutionary algorithm

ABSTRACT Modern society is prominently dependent on information and communication technology over the last few decades has carried it with more vulnerability to an enormous variety of cyber-attacks. One of the attacks is a Distributed Denial-of-Service (DDoS) that exploits the power of thousands and sometimes hundreds of thousands of compromised computers to attack information-providing services and online commercial sites, often resulting in significant downtime and financial losses and thereby denying services of legitimate clients. The study of DDoS attacks is a significant area of research; there are a number of techniques that have been proposed such as evolutionary algorithm and artificial intelligence in the literature for detecting DDoS attacks. Unfortunately, the modern well-known DDoS detection schemes are deteriorating to validate the objective and prior recognition of DDoS attacks. In order to mitigate denial of service attacks, in this paper, we use grasshopper optimization algorithm (GOA) with machine learning algorithm called GOIDS. This approach is based on creating an intrusion detection system (IDS) to fulfill the requirements of the monitored environment and able to distinguish between normal and attack traffics. Furthermore, GOIDS selects the most relevant features from the original IDS dataset that can help to distinguish typical low-speed DDoS attacks and then, selected features are passed to the classifiers, i.e. support vector machine, decision tree, naïve Bayes, and multilayer perceptron to identify type of attack. The publicly available dataset as KDD Cup 99 and CIC-IDS 2017 are used for our experimental study. From the results of the simulation, it is clear that GOIDS with decision tree acquires high detection and accuracy with a low false–positive rate.

A Novel PCA-Firefly Based XGBoost Classification Model for Intrusion Detection in Networks Using GPU

The enormous popularity of the internet across all spheres of human life has introduced various risks of malicious attacks in the network. The activities performed over the network could be effortlessly proliferated, which has led to the emergence of intrusion detection systems. The patterns of the attacks are also dynamic, which necessitates efficient classification and prediction of cyber attacks. In this paper we propose a hybrid principal component analysis (PCA)-firefly based machine learning model to classify intrusion detection system (IDS) datasets. The dataset used in the study is collected from Kaggle. The model first performs One-Hot encoding for the transformation of the IDS datasets. The hybrid PCA-firefly algorithm is then used for dimensionality reduction. The XGBoost algorithm is implemented on the reduced dataset for classification. A comprehensive evaluation of the model is conducted with the state of the art machine learning approaches to justify the superiority of our proposed approach. The experimental results confirm the fact that the proposed model performs better than the existing machine learning models.

Synthetic Minority Oversampling Technique for Optimizing Classification Tasks in Botnet and Intrusion-Detection-System Datasets

Presently, security is a hot research topic due to the impact in daily information infrastructure. Machine-learning solutions have been improving classical detection practices, but detection tasks employ irregular amounts of data since the number of instances that represent one or several malicious samples can significantly vary. In highly unbalanced data, classification models regularly have high precision with respect to the majority class, while minority classes are considered noise due to the lack of information that they provide. Well-known datasets used for malware-based analyses like botnet attacks and Intrusion Detection Systems (IDS) mainly comprise logs, records, or network-traffic captures that do not provide an ideal source of evidence as a result of obtaining raw data. As an example, the numbers of abnormal and constant connections generated by either botnets or intruders within a network are considerably smaller than those from benign applications. In most cases, inadequate dataset design may lead to the downgrade of a learning algorithm, resulting in overfitting and poor classification rates. To address these problems, we propose a resampling method, the Synthetic Minority Oversampling Technique (SMOTE) with a grid-search algorithm optimization procedure. This work demonstrates classification-result improvements for botnet and IDS datasets by merging synthetically generated balanced data and tuning different supervised-learning algorithms.

Incorporating evolutionary computation for securing wireless network against cyberthreats

Due to the rapid growth of internet services, the demand for protection and security of the network against sophisticated attacks is continuously increasing. Nowadays, in network security, an intrusion detection system (IDS) plays an important role to detect intrusive activity. With the purpose of reducing the search dimensionality and enhancing classification performance of IDS model, in the literature several hybrid evolutionary algorithms have been investigated to tackle anomaly detection problems, but they have few drawbacks such as poor diversity, massive false negative rate, and stagnation. To resolve these limitations, in this study, we introduce a new hybrid evolutionary algorithm combining the techniques of grasshopper optimization algorithm (GOA) and simulated annealing (SA), called GOSA for IDS that extracts the most noteworthy features and eliminates irrelevant ones from the original IDS datasets. In the proposed method, SA is integrated into GOA, while utilizing it to increase the solution quality after each iteration of GOA. Support vector machine is used as a fitness function in the proposed method to select relevant features which can help to classify attacks accurately. The performance of the proposed method is evaluated on two IDS datasets such as NSL-KDD and UNSW-NB15. From experimental results, we observe that the proposed method outperforms existing state-of-the-art methods and attains high detection rate as 99.86%, an accuracy as 99.89%, and low false alarm rate as 0.009 in NSL-KDD and high detection rate as 98.85%, an accuracy as 98.96%, and low false alarm rate as 0.084 in UNSW-NB15.

A Review of the Advancement in Intrusion Detection Datasets

The research in the field of Cyber Security has raised the need to address the issue of cybercrimes that have caused the requisition of the intellectual properties such as break down of computer systems, impairment of important data, compromising the confidentiality, authenticity, and integrity of the user. Considering these scenarios, it is essential to secure the computer systems and the user using an Intrusion Detection System (IDS). The performance of IDS studied by developing an IDS dataset, consisting of network traffic features to learn the attack patterns. Intrusion detection is a classification problem, wherein various Machine Learning (ML) and Data Mining (DM) techniques applied to classify the network data into normal and attack traffic. Moreover, the types of network attacks changed over the years, and therefore, there is a need to update the datasets used for evaluating IDS. This paper list the different IDS datasets used for the evaluation of IDS model. The paper presents an overview of the ML and DM techniques used for IDS along with the discussion on CIC-IDS-2017 and CSE-CIC-IDS-2018. These are recent datasets consisting of network attack features and include new attacks categories. This paper discusses the recent advancement in the IDS datasets that can be used by various research communities as the manifesto for using the new IDS datasets for developing efficient and effective ML and DM based IDS.

LSTM-Based Intrusion Detection System for In-Vehicle Can Bus Communications

The modern automobile is a complex piece of technology that uses the Controller Area Network (CAN) bus system as a central system for managing the communication between the electronic control units (ECUs). Despite its central importance, the CAN bus system does not support authentication and authorization mechanisms, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways including Denial of Service (DoS), Fuzzing and Spoofing attacks. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We generate our own dataset by first extracting attack-free data from our experimental car and by injecting attacks into the latter and collecting the dataset. We use the dataset for testing and training our model. With our selected hyper-parameter values, our results demonstrate that our classifier is efficient in detecting the CAN bus network attacks, we achieved an overall detection accuracy of 99.995%. We also compare the proposed LSTM method with the Survival Analysis for automobile IDS dataset which is developed by the Hacking and Countermeasure Research Lab, Korea. Our proposed LSTM model achieves a higher detection rate than the Survival Analysis method.

Evolving deep learning architectures for network intrusion detection using a double PSO metaheuristic

The prevention of intrusion is deemed to be a cornerstone of network security. Although excessive work has been introduced on network intrusion detection in the last decade, finding an Intrusion Detection Systems (IDS) with potent intrusion detection mechanism is still highly desirable. One of the leading causes of the high number of false alarms and a low detection rate is the existence of redundant and irrelevant features of the datasets, which are used to train the IDSs. To cope with this problem, we proposed a double Particle Swarm Optimization (PSO)-based algorithm to select both feature subset and hyperparameters in one process. The aforementioned algorithm is exploited in the pre-training phase for selecting the optimized features and model’s hyperparameters automatically. In order to investigate the performance differences, we utilized three deep learning models, namely, Deep Neural Networks (DNN), Long Short-Term Memory Recurrent Neural Networks (LSTM-RNN), and Deep Belief Networks (DBN). Furthermore, we used two common IDS datasets in our experiments to validate our approach and show the effectiveness of the developed models. Moreover, many evaluation metrics are used for both binary and multiclass classifications to assess the model’s performance in each of the datasets. Finally, intensive quantitative, Friedman test, and ranking methods analyses of our results are provided at the end of this paper. Experimental results show a significant improvement in network intrusion detection when using our approach by increasing Detection Rate (DR) by 4% to 6% and reducing False Alarm Rate (FAR) by 1% to 5% from the corresponding values of same models without pre-training on the same dataset.

Cyberattack triage using incremental clustering for intrusion detection systems

Intrusion detection systems (IDSs) are devices or software applications that monitor networks or systems for malicious activities and signals alerts/alarms when such activity is discovered. However, an IDS may generate many false alerts which affect its accuracy. In this paper, we develop a cyberattack triage algorithm to detect these alerts (so-called outliers). The proposed algorithm is designed using the clustering, optimization and distance-based approaches. An optimization-based incremental clustering algorithm is proposed to find clusters of different types of cyberattacks. Using a special procedure, a set of clusters is divided into two subsets: normal and stable clusters. Then, outliers are found among stable clusters using an average distance between centroids of normal clusters. The proposed algorithm is evaluated using the well-known IDS data sets—Knowledge Discovery and Data mining Cup 1999 and UNSW-NB15—and compared with some other existing algorithms. Results show that the proposed algorithm has a high detection accuracy and its false negative rate is very low.