Machine learning approaches to network intrusion detection for contemporary internet traffic

Artificial Intelligence plays a significant role in building effective cybersecurity tools. Security has a crucial role in the modern digital world and has become an essential area of research. Network Intrusion Detection Systems (NIDS) are among the first security systems that encounter network attacks and facilitate attack detection to protect a network. Contemporary machine learning approaches, like novel neural network architectures, are succeeding in network intrusion detection. This paper tests modern machine learning approaches on a novel cybersecurity benchmark IoT dataset. Among other algorithms, Deep AutoEncoder (DAE) and modified Long Short Term Memory (mLSTM) are employed to detect network anomalies in the IoT-23 dataset. The DAE is employed for dimensionality reduction and a host of ML methods, including Deep Neural Networks and Long Short-Term Memory to classify the outputs of into normal/malicious. The applied method is validated on the IoT-23 dataset. Furthermore, the results of the analysis in terms of evaluation matrices are discussed.

Download Full-text

Data mining tools -a case study for network intrusion detection

Multimedia Tools and Applications ◽

10.1007/s11042-020-09916-0 ◽

2020 ◽

Author(s):

Soodeh Hosseini ◽

Saman Rafiee Sardo

Keyword(s):

Machine Learning ◽

Data Mining ◽

Intrusion Detection ◽

Network Intrusion Detection ◽

Learning Approaches ◽

Learning Tools ◽

Network Intrusion ◽

The Face ◽

Level Of Knowledge ◽

Mining Tools

Abstract With the growth of data mining and machine learning approaches in recent years, many efforts have been made to generalize these sciences so that researchers from any field can easily utilize these sciences. One of the most important of these efforts is the development of data mining tools that try to hide the complexities from researchers so that they can achieve a professional output with any level of knowledge. This paper is focused on reviewing and comparing data mining and machine learning tools including WEKA, KNIME, Keel, Orange, Azure, IBM SPSS Modeler, R and Scikit-Learn to show what approach each of these methods has taken in the face of the complexities and problems of different scenarios of generalization of data mining and machine learning. In addition, for a more detailed review, this paper examines the challenge of network intrusion detection in two tools, Knime with graphical interface and Scikit-Learn with coding environment.

Download Full-text

Towards a Reliable Comparison and Evaluation of Network Intrusion Detection Systems Based on Machine Learning Approaches

Applied Sciences ◽

10.3390/app10051775 ◽

2020 ◽

Vol 10 (5) ◽

pp. 1775 ◽

Cited By ~ 6

Author(s):

Roberto Magán-Carrión ◽

Daniel Urda ◽

Ignacio Díaz-Cano ◽

Bernabé Dorronsoro

Keyword(s):

Machine Learning ◽

Intrusion Detection ◽

Attack Detection ◽

Intrusion Detection Systems ◽

Network Intrusion Detection ◽

Learning Approaches ◽

Network Attack ◽

Detection Systems ◽

Network Intrusion ◽

Network Intrusion Detection Systems

Presently, we are living in a hyper-connected world where millions of heterogeneous devices are continuously sharing information in different application contexts for wellness, improving communications, digital businesses, etc. However, the bigger the number of devices and connections are, the higher the risk of security threats in this scenario. To counteract against malicious behaviours and preserve essential security services, Network Intrusion Detection Systems (NIDSs) are the most widely used defence line in communications networks. Nevertheless, there is no standard methodology to evaluate and fairly compare NIDSs. Most of the proposals elude mentioning crucial steps regarding NIDSs validation that make their comparison hard or even impossible. This work firstly includes a comprehensive study of recent NIDSs based on machine learning approaches, concluding that almost all of them do not accomplish with what authors of this paper consider mandatory steps for a reliable comparison and evaluation of NIDSs. Secondly, a structured methodology is proposed and assessed on the UGR’16 dataset to test its suitability for addressing network attack detection problems. The guideline and steps recommended will definitively help the research community to fairly assess NIDSs, although the definitive framework is not a trivial task and, therefore, some extra effort should still be made to improve its understandability and usability further.

Download Full-text