A comparative simulation of normalization methods for machine learning-based intrusion detection systems using KDD Cup’99 dataset

Network Intrusion detection systems (NIDS) detect malicious and intrusive information in computer networks. Presently, commercial NIDS is based on machine learning approaches that have complex algorithms and increase intrusion detection efficiency and efficacy. These machine learning-based NIDS use high dimensional network traffic data from which intrusive information is to be detected. This high-dimensional network traffic data in NIDS needs to be preprocessed and normalized to make it suitable for machine learning tools. A machine learning approach with appropriate normalization and prepossessing increases NIDS performance. This paper presents an empirical study on various normalization methods implemented on a benchmark network traffic dataset, KDD Cup’99, that has been used to evaluate the NIDS model. The present study shows decimal normalization has a better prediction performance than non-normalized traffic data categorized into ‘normal’ or ‘intrusive’ classes.

Download Full-text

A System to automate the development of anomaly-based network intrusion detection model

Journal of Physics Conference Series ◽

10.1088/1742-6596/2089/1/012006 ◽

2021 ◽

Vol 2089 (1) ◽

pp. 012006

Author(s):

B Padmaja ◽

K Sai Sravan ◽

E Krishna Rao Patro ◽

G Chandra Sekhar

Keyword(s):

Machine Learning ◽

Intrusion Detection ◽

Real Time ◽

Network Traffic ◽

Intrusion Detection Systems ◽

Network Intrusion Detection ◽

Support Vector ◽

The Internet ◽

Detection Systems ◽

Network Intrusion

Abstract Cyber security is the major concern in today’s world. Over the past couple of decades, the internet has grown to such an extent that almost every individual living on this planet has the access to the internet today. This can be viewed as one of the major achievements in the human race, but on the flip side of the coin, this gave rise to a lot of security issues for every individual or the company that is accessing the web through the internet. Hackers have become active and are always monitoring the networks to grab every possible opportunity to attack a system and make the best fortune out of its vulnerabilities. To safeguard people’s and organization’s privacy in this cyberspace, different network intrusion detection systems have been developed to detect the hacker’s presence in the networks. These systems fall under signature based and anomaly based intrusion detection systems. This paper deals with using anomaly based intrusion detection technique to develop an automation system to both train and test supervised machine learning models, which is developed to classify real time network traffic as to whether it is malicious or not. Currently the best models by considering both detection success rate and the false positives rate are Artificial Neural Networks(ANN) followed by Support Vector Machines(SVM). In this paper, it is verified that Artificial Neural Network (ANN) based machine learning with wrapper feature selection outperforms support vector machine (SVM) technique while classifying network traffic as harmful or harmless. Initially to evaluate the performance of the system, NSL-KDD dataset is used to train and test the SVM and ANN models and finally classify real time network traffic using these models. This system can be used to carry out model building automatically on the new datasets and also for classifying the behaviour of the provided dataset without having to code.

Download Full-text

Extending Isolation Forest for Anomaly Detection in Big Data via K-Means

ACM Transactions on Cyber-Physical Systems ◽

10.1145/3460976 ◽

2021 ◽

Vol 5 (4) ◽

pp. 1-26

Author(s):

Md Tahmid Rahman Laskar ◽

Jimmy Xiangji Huang ◽

Vladan Smetana ◽

Chris Stewart ◽

Kees Pouw ◽

...

Keyword(s):

Big Data ◽

Intrusion Detection ◽

Anomaly Detection ◽

Computer Networks ◽

Network Traffic ◽

Intrusion Detection Systems ◽

Traffic Data ◽

Detection Systems ◽

Proposed Model ◽

Isolation Forest

Industrial Information Technology infrastructures are often vulnerable to cyberattacks. To ensure security to the computer systems in an industrial environment, it is required to build effective intrusion detection systems to monitor the cyber-physical systems (e.g., computer networks) in the industry for malicious activities. This article aims to build such intrusion detection systems to protect the computer networks from cyberattacks. More specifically, we propose a novel unsupervised machine learning approach that combines the K-Means algorithm with the Isolation Forest for anomaly detection in industrial big data scenarios. Since our objective is to build the intrusion detection system for the big data scenario in the industrial domain, we utilize the Apache Spark framework to implement our proposed model that was trained in large network traffic data (about 123 million instances of network traffic) stored in Elasticsearch. Moreover, we evaluate our proposed model on the live streaming data and find that our proposed system can be used for real-time anomaly detection in the industrial setup. In addition, we address different challenges that we face while training our model on large datasets and explicitly describe how these issues were resolved. Based on our empirical evaluation in different use cases for anomaly detection in real-world network traffic data, we observe that our proposed system is effective to detect anomalies in big data scenarios. Finally, we evaluate our proposed model on several academic datasets to compare with other models and find that it provides comparable performance with other state-of-the-art approaches.

Download Full-text

An Artificial Intelligence-based Intrusion Detection System

Journal of Cybersecurity and Information Management ◽

10.54216/jcim.07.02.04 ◽

2021 ◽

Vol 07 (02) ◽

pp. 95-111

Author(s):

Thani Almuhairi ◽

◽

Ahmad Almarri ◽

Khalid Hokal ◽

Keyword(s):

Artificial Intelligence ◽

Machine Learning ◽

Intrusion Detection ◽

Network Traffic ◽

Detection System ◽

Intrusion Detection Systems ◽

Learning Approaches ◽

Malicious Attacks ◽

Medical Systems ◽

Detection Systems

Intrusion detection systems have been used in many systems to avoid malicious attacks. Traditionally, these intrusion detection systems use signature-based classification to detect predefined attacks and monitor the network's overall traffic. These intrusion detection systems often fail when an unseen attack occurs, which does not match with predefined attack signatures, leaving the system hopeless and vulnerable. In addition, as new attacks emerge, we need to update the database of attack signatures, which contains the attack information. This raises concerns because it is almost impossible to define every attack in the database and make the process costly also. Recently, research in conjunction with artificial intelligence and network security has evolved. As a result, it created many possibilities to enable machine learning approaches to detect the new attacks in network traffic. Machine learning has already shown successful results in the domain of recommendation systems, speech recognition, and medical systems. So, in this paper, we utilize machine learning approaches to detect attacks and classify them. This paper uses the CSE-CIC-IDS dataset, which contains normal and malicious attacks samples. Multiple steps are performed to train the network traffic classifier. Finally, the model is deployed for testing on sample data.

Download Full-text

SCADA Vulnerabilities and Existing Security Approaches Towards Industrial Protection

International Journal of Innovative Technology and Exploring Engineering - Special Issue ◽

10.35940/ijitee.j7634.0991120 ◽

2020 ◽

Vol 9 (11) ◽

pp. 258-264

Keyword(s):

Intrusion Detection ◽

Network Traffic ◽

Distribution Systems ◽

Communication Protocols ◽

Intrusion Detection Systems ◽

Security Level ◽

Traffic Data ◽

Open Communication ◽

Detection Systems ◽

Scada Networks

Attackers, spread all around the world, have become a major threat to SCADA systems, since they started using opened-standard networks, integrated to corporate networks and accessing the Internet. It is true that there are also many different security solutions and techniques available, such as firewalls, encryption, network traffic analysis and a few others, though, intruders still managed to gain access and control delicate systems. Pointed as a non-invasive solution, intrusion detection systems (IDS) are able to monitor and report activities of any anomaly or strange patterns. However, due to the lack of SCADA network traffic data, such IDS solutions are still primitive and based on just well-known vulnerabilities and attacks, where a dedicated IDS is necessary to properly protect SCADA in water distribution systems. This study highlights SCADA vulnerabilities and security issues, through a qualitative approach, using known attacks and examples in security as case studies and aiming to present scenarios on this issue, as well, an overview of today’s SCADA vulnerabilities and main threats. Results show that the identification of Intrusion Detection Systems (IDS), with their approaches and types, also widely implemented in regular IT networks, help on providing a higher security level and identifying abnormal traffic data. Such systems have indeed shown a good success rate on identifying malicious traffic in SCADA networks, mainly because of their evolution to Ethernet and open communication protocols. Based on these singular characteristics, studying SCADA networks and their communication protocols is seen as a major factor to properly develop robust security mechanisms and tolls.

Download Full-text

Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT

Journal of Cybersecurity and Privacy ◽

10.3390/jcp1020014 ◽

2021 ◽

Vol 1 (2) ◽

pp. 252-273

Author(s):

Pavlos Papadopoulos ◽

Oliver Thornewill von Essen ◽

Nikolaos Pitropakis ◽

Christos Chrysoulas ◽

Alexios Mylonas ◽

...

Keyword(s):

Machine Learning ◽

Intrusion Detection ◽

Intrusion Detection Systems ◽

Learning Models ◽

Detection Systems ◽

Network Intrusion ◽

Robust Model ◽

Significant Probability ◽

Adversarial Examples ◽

Attack Surface

As the internet continues to be populated with new devices and emerging technologies, the attack surface grows exponentially. Technology is shifting towards a profit-driven Internet of Things market where security is an afterthought. Traditional defending approaches are no longer sufficient to detect both known and unknown attacks to high accuracy. Machine learning intrusion detection systems have proven their success in identifying unknown attacks with high precision. Nevertheless, machine learning models are also vulnerable to attacks. Adversarial examples can be used to evaluate the robustness of a designed model before it is deployed. Further, using adversarial examples is critical to creating a robust model designed for an adversarial environment. Our work evaluates both traditional machine learning and deep learning models’ robustness using the Bot-IoT dataset. Our methodology included two main approaches. First, label poisoning, used to cause incorrect classification by the model. Second, the fast gradient sign method, used to evade detection measures. The experiments demonstrated that an attacker could manipulate or circumvent detection with significant probability.

Download Full-text