A hybrid model for anomaly-based intrusion detection in SCADA networks

From 2012 to 2015, her research concerned performance improvement of communication networks. Since 2015, she has been a Graduate Research Assistant with Washington University in St. Louis. Her current research interests include utilizing machine learning and deep learning for network security of the Industrial Internet of Things, Internet of Things, machine learning, cyber-security, secure computer networks, and wireless communications. Marcio A. Teixeira (M'18-SM'18) received the M.Sc. degree in computer science and the Ph.D. degree in electrical engineering from the Federal

show abstract

“…Ullah and Mahmoud [19] suggested an IDS using a combination of J48 and I Bayes techniques. J48 is a type of decision tree (DT) technique.…”

Section: A Integritymentioning

confidence: 99%

“…As mentioned in Section IV-A, Ullah and Mahmoud [19] covered confidentiality problem through reconnaissance attack.…”

Section: Confidentialitymentioning

confidence: 99%

Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things

Zolanvari

Teixeira

Gupta

et al. 2019

IEEE Internet Things J.

333

149

View full text Add to dashboard Cite

show abstract

“…An intrusion detection framework for smart-grid was proposed in [12]. The training and testing time can be significantly decreased by using a simplified set of features [13]. A filter-based feature selection model proposed [13,14] removing redundant and irrelevant features from the ISCX and NSL-KDD datasets.…”

Section: Related Workmentioning

confidence: 99%

“…The training and testing time can be significantly decreased by using a simplified set of features [13]. A filter-based feature selection model proposed [13,14] removing redundant and irrelevant features from the ISCX and NSL-KDD datasets. Umer et al [5] deliberate techniques and challenges for flow-based intrusion detection.…”

Section: Related Workmentioning

confidence: 99%

A Two-Level Flow-Based Anomalous Activity Detection System for IoT Networks

Ullah

Mahmoud

2020

Electronics

Self Cite

View full text Add to dashboard Cite

The significant increase of the Internet of Things (IoT) devices in smart homes and other smart infrastructure, and the recent attacks on these IoT devices, are motivating factors to secure and protect IoT networks. The primary security challenge to develop a methodology to identify a malicious activity correctly and mitigate the impact of such activity promptly. In this paper, we propose a two-level anomalous activity detection model for intrusion detection system in IoT networks. The level-1 model categorizes the network flow as normal flow or abnormal flow, while the level-2 model classifies the category or subcategory of detected malicious activity. When the network flow classified as an anomaly by the level-1 model, then the level-1 model forwards the stream to the level-2 model for further investigation to find the category or subcategory of the detected anomaly. Our proposed model constructed on flow-based features of the IoT network. Flow-based detection methodologies only inspect packet headers to classify the network traffic. Flow-based features extracted from the IoT Botnet dataset and various machine learning algorithms were investigated and tested via different cross-fold validation tests to select the best algorithm. The decision tree classifier yielded the highest predictive results for level-1, and the random forest classifier produced the highest predictive results for level-2. Our proposed model Accuracy, Precision, Recall, and F score for level-1 were measured as 99.99% and 99.90% for level-2. A two-level anomalous activity detection system for IoT networks we proposed will provide a robust framework for the development of malicious activity detection system for IoT networks. It would be of interest to researchers in academia and industry.

show abstract

“…A hybrid machine learning approach was designed to recognize zero-day attacks in Supervisory Control and Data Acquisition (SCADA) networks [8]. In order to achieve better results, filter-based feature selection approach was used to elicit appropriate features.…”

Section: Introduction and Related Workmentioning

confidence: 99%

A predictive model for network intrusion detection using stacking approach

Rajagopal¹,

Kundapur²,

Hareesha³

2020

IJECE

View full text Add to dashboard Cite

Due to the emerging technological advances, cyber-attacks continue to hamper information systems. The changing dimensionality of cyber threat landscape compel security experts to devise novel approaches to address the problem of network intrusion detection. Machine learning algorithms are extensively used to detect intrusions by dint of their remarkable predictive power. This work presents an ensemble approach for network intrusion detection using a concept called Stacking. As per the popular no free lunch theorem of machine learning, employing single classifier for a problem at hand may not be ideal to achieve generalization. Therefore, the proposed work on network intrusion detection emphasizes upon a combinative approach to improve performance. A robust processing paradigm called Graphlab Create, capable of upholding massive data has been used to implement the proposed methodology. Two benchmark datasets like UNSW NB-15 and UGR’ 16 datasets are considered to demonstrate the validity of predictions. Empirical investigation has illustrated that the performance of the proposed approach has been reasonably good. The contribution of the proposed approach lies in its finesse to generate fewer misclassifications pertaining to various attack vectors considered in the study.

show abstract

A hybrid model for anomaly-based intrusion detection in SCADA networks

Cited by 48 publications

References 18 publications

Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things

Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things

A Two-Level Flow-Based Anomalous Activity Detection System for IoT Networks

A predictive model for network intrusion detection using stacking approach

Contact Info

Product

Resources

About