A Filter Feature Selection Algorithm Based on Mutual Information for Intrusion Detection

Zhao, Fei; Zhao, Jiyong; Niu, Xinxin; Si, Luo; Xin, Yang

doi:10.3390/app8091535

Cited by 34 publications

(23 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An example of feature selection technique used in the context of the network anomaly intrusion detection can be found in [37], where the authors proposed a framework aimed to improve the performance by exploiting a feature selection technique. An approach based on the mutual information used to perform the feature selection in the intrusion detection context is defined in [38], whereas an interesting approach that combines several feature selection algorithms is presented in [39]. Another interesting approaches of feature selection is presented in [40], where the authors formalize such a technique in terms of a pigeon-inspired optimizer algorithm, applying it in an intrusion detection scenario.…”

Section: Related Workmentioning

confidence: 99%

A Local Feature Engineering Strategy to Improve Network Anomaly Detection

et al. 2020

View full text Add to dashboard Cite

The dramatic increase in devices and services that has characterized modern societies in recent decades, boosted by the exponential growth of ever faster network connections and the predominant use of wireless connection technologies, has materialized a very crucial challenge in terms of security. The anomaly-based intrusion detection systems, which for a long time have represented some of the most efficient solutions to detect intrusion attempts on a network, have to face this new and more complicated scenario. Well-known problems, such as the difficulty of distinguishing legitimate activities from illegitimate ones due to their similar characteristics and their high degree of heterogeneity, today have become even more complex, considering the increase in the network activity. After providing an extensive overview of the scenario under consideration, this work proposes a Local Feature Engineering (LFE) strategy aimed to face such problems through the adoption of a data preprocessing strategy that reduces the number of possible network event patterns, increasing at the same time their characterization. Unlike the canonical feature engineering approaches, which take into account the entire dataset, it operates locally in the feature space of each single event. The experiments conducted on real-world data showed that this strategy, which is based on the introduction of new features and the discretization of their values, improves the performance of the canonical state-of-the-art solutions.

show abstract

Section: Related Workmentioning

confidence: 99%

A Local Feature Engineering Strategy to Improve Network Anomaly Detection

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The dataset has many intrusion attacks simulated in a military-grade network. The KDDcup99 dataset is considered as the benchmark tagged dataset [45] that is commonly used for assessing the network intrusion detection methods. Here we use the 10% KDD training data subset.…”

Section: Datasetmentioning

confidence: 99%

“…Considering different types of attack, on average, we proposed method performs better than other considered methods. However, statistically the ranking of the proposed method is statistically undistinguishable from the methods of Zhao et al [45], Le et al [37], and Papamartzivanos et al [48]. Following the recommendation of Demšar [50], we used a series of statistical tests to compare the methods.…”

Section: Accuracymentioning

confidence: 99%

Network Intrusion Detection with a Hashing Based Apriori Algorithm Using Hadoop MapReduce

et al. 2019

View full text Add to dashboard Cite

Ubiquitous nature of Internet services across the globe has undoubtedly expanded the strategies and operational mode being used by cybercriminals to perpetrate their unlawful activities through intrusion on various networks. Network intrusion has led to many global financial loses and privacy problems for Internet users across the globe. In order to safeguard the network and to prevent Internet users from being the regular victims of cyber-criminal activities, new solutions are needed. This research proposes solution for intrusion detection by using the improved hashing-based Apriori algorithm implemented on Hadoop MapReduce framework; capable of using association rules in mining algorithm for identifying and detecting network intrusions. We used the KDD dataset to evaluate the effectiveness and reliability of the solution. Our results obtained show that this approach provides a reliable and effective means of detecting network intrusion.

show abstract

“…A growing number of HMM-based NIDS have been developed in recent years, which have been applied either to misuse detection to model a predefined set of attacks, or in anomaly detection to model normal behavior patterns, such as in [16]. Most importantly, the HMM-based applications in anomaly and misuse detection have emerged in both the main categories of Intrusion Detection System (IDS): (1) host-based IDS (HIDS) in [17] and (2) network-based IDS (NIDS) in [18,19,27]. The HMM has recently begun to emerge in applications of Wireless IDS (WIDS) [20].…”

Section: Motivationmentioning

confidence: 99%

AA-HMM: An Anti-Adversarial Hidden Markov Model for Network-Based Intrusion Detection

2018

View full text Add to dashboard Cite

In the field of network intrusion, malware usually evades anomaly detection by disguising malicious behavior as legitimate access. Therefore, detecting these attacks from network traffic has become a challenge in this an adversarial setting. In this paper, an enhanced Hidden Markov Model, called the Anti-Adversarial Hidden Markov Model (AA-HMM), is proposed to effectively detect evasion pattern, using the Dynamic Window and Threshold techniques to achieve adaptive, anti-adversarial, and online-learning abilities. In addition, a concept called Pattern Entropy is defined and acts as the foundation of AA-HMM. We evaluate the effectiveness of our approach employing two well-known benchmark data sets, NSL-KDD and CTU-13, in terms of the common performance metrics and the algorithm’s adaptation and anti-adversary abilities.

show abstract

A Filter Feature Selection Algorithm Based on Mutual Information for Intrusion Detection

Cited by 34 publications

References 42 publications

A Local Feature Engineering Strategy to Improve Network Anomaly Detection

A Local Feature Engineering Strategy to Improve Network Anomaly Detection

Network Intrusion Detection with a Hashing Based Apriori Algorithm Using Hadoop MapReduce

AA-HMM: An Anti-Adversarial Hidden Markov Model for Network-Based Intrusion Detection

Contact Info

Product

Resources

About