A hybrid method based on genetic algorithm, self-organised feature map, and support vector machine for better network anomaly detection

Anil, Swathi; Remya, R.

doi:10.1109/icccnt.2013.6726604

Cited by 23 publications

(5 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Among those papers, we were able to identify three categories based on the type of task they address. The first group of papers presents a novel hybrid method for network anomaly detection by incorporating both supervised and unsupervised methods in their work [ 64 , 65 , 66 ], while the second group also presents a novel hybrid method, but also a more in-depth evaluation compared to some other methods [ 67 ]. In the third group, which focuses exclusively on the comparison between different ML techniques, a total of six papers were identified.…”

Section: Related Workmentioning

confidence: 99%

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Komadina,

Kovačević,

Štengl

et al. 2024

Sensors

View full text Add to dashboard Cite

Detecting anomalies in large networks is a major challenge. Nowadays, many studies rely on machine learning techniques to solve this problem. However, much of this research depends on synthetic or limited datasets and tends to use specialized machine learning methods to achieve good detection results. This study focuses on analyzing firewall logs from a large industrial control network and presents a novel method for generating anomalies that simulate real attacker actions within the network without the need for a dedicated testbed or installed security controls. To demonstrate that the proposed method is feasible and that the constructed logs behave as one would expect real-world logs to behave, different supervised and unsupervised learning models were compared using different feature subsets, feature construction methods, scaling methods, and aggregation levels. The experimental results show that unsupervised learning methods have difficulty in detecting the injected anomalies, suggesting that they can be seamlessly integrated into existing firewall logs. Conversely, the use of supervised learning methods showed significantly better performance compared to unsupervised approaches and a better suitability for use in real systems.

show abstract

Section: Related Workmentioning

confidence: 99%

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Komadina,

Kovačević,

Štengl

et al. 2024

Sensors

View full text Add to dashboard Cite

show abstract

“…C8 [41] KDD99 dataset In this model, GA and SOFM were used for feature extraction on the dataset. e goal was feature reduction on the dataset to be used in training SVM.…”

Section: Datasetmentioning

confidence: 99%

A Systematic Review on Hybrid Intrusion Detection System

Maseno

Wang

Xing

2022

Security and Communication Networks

View full text Add to dashboard Cite

As computer networks keep growing at a high rate, achieving confidentiality, integrity, and availability of the information system is essential. Intrusion detection systems (IDSs) have been widely used to monitor and secure networks. The two major limitations facing existing intrusion detection systems are high rates of false-positive alerts and low detection rates on zero-day attacks. To overcome these problems, we need intrusion detection techniques that can learn and effectively detect intrusions. Hybrid methods based on machine learning techniques have been proposed by different researchers. These methods take advantage of the single detection methods and leverage their weakness. Therefore, this paper reviews 111 related studies in the period between 2012 and 2022 focusing on hybrid detection systems. The review points out the existing gaps in the development of hybrid intrusion detection systems and the need for further research in this area.

show abstract

“…An anomaly detection method has been emphasized by using an information gain based feature selection method and SOM algorithm in the study carried out on the detection of network based attacks by Anil and Remya [5]. KDD99 (International Information Discovery and Data Mining Competition, 1999) data sets were used for feature selection and evaluating the performance of anomaly-based systems and.…”

Section: Current Studiesmentioning

confidence: 99%

“…However, anomaly detection can be used effectively in different areas, especially in cancer surveillance and military surveillance of hostile activities [6]. There are several techniques developed for anomaly detection [5][6] [7]. One of these techniques is "Clustering Based Anomaly Detection with Artificial Neural Networks" [3].…”

Section: Introductionmentioning

confidence: 99%

Anomaly Detection Using Data Mining Methods in IT Systems: A Decision Support Application

Sönmez

Zontul

Kaynar

et al. 2018

Sakarya University Journal of Science

View full text Add to dashboard Cite

Although there are various studies on anomaly detection, effective and simple anomaly detection approaches are necessary as the inadequacy of appropriate ways for substantial network environments. In the existing analysis methods, it is seen that the methods of preliminary analysis are generally used, the extrapolations and probabilities are not taken into account and the unsupervised neural network (NN) methods are not used enough. As an alternative, the use of the Self-Organizing Maps has been preferred in the study. In other studies, analysis of data obtained from network traffic is analyzed, here, analysis of other information systems data and suggestions for alternative solutions are given, too. In addition, in-memory database systems have been used in practice in order to enable faster processing in analysis studies, due to the large size of data to be analyzed in large-scale network environments. An analysis of the application log data obtained from the management tools in the information systems was carried out. After anomaly detection results obtained and the verification test results are compared, it is found out that anomaly detection process is successful by 96%. The advantage offered for the company and users at IT and security monitoring processes is to eliminate the need for pre-qualification and to reduce the heavy workload. By this way, it is thought that a significant cost item is eliminated. It is also contemplated that the security vulnerabilities and problems associated with unpredictable issues will be detected through practice and thus many attacks and problems will be prevented in advance.

show abstract

A hybrid method based on genetic algorithm, self-organised feature map, and support vector machine for better network anomaly detection

Cited by 23 publications

References 7 publications

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

A Systematic Review on Hybrid Intrusion Detection System

Anomaly Detection Using Data Mining Methods in IT Systems: A Decision Support Application

Contact Info

Product

Resources

About