A Novel Framework for NIDS Throuh Fast Knn Classifier on CICIDS 2017 Dataset

Abstract

This paper investigates the performance of a Fast kNearest Neighbor Classifier (FkNN) for Network Intrusion Detection System (NIDS) on Cloud Environment. For this study Variance Index based Partial Distance Search (VIPDS) kNN [7] is adopted as an FkNN classifier. A benchmark dataset CICIDS2017[16] is considered for the evaluation process because it is a 78 featured dataset with most updated cloud related attacks. To achieve this objective a frame work is proposed for implementing FkNN and compared with kNN classifier by considering two performance measures Accuracy and computational time. This study explores the gain in the computational time without compromising the Accuracy while using FkNN instead of kNN over a large featured dataset. The conclusions are drawn as per the results obtained from the experiments conducted on CICIDS2017 dataset.

AWC‐NIDS: Attack‐wise customized network intrusion detection system using machine learning, concurrency, and distributed systems

“…Vamsi Krishna et al published an article to improve the kNN-based classification process in terms of time; therefore, a Fast kNN framework was proposed. 23 The proposed method was evaluated on the CICIDS2017 DDoS dataset. The Fast kNN exhibited high performance on the dataset, and the reported accuracy, precision, and recall values were above 99%, as in the present study.…”

“…Vamsi Krishna et al published an article to improve the kNN‐based classification process in terms of time; therefore, a Fast kNN framework was proposed 23 . The proposed method was evaluated on the CICIDS2017 DDoS dataset.…”

“…Finally, the most significant botnet detection model was found as the combined Correlation Attribute Eval (filter) with JRip (classifier). The study in Reference 23 investigated the performance of a variant of k‐NN classifier, which was called Fast kNN (FkNN), Variance Index based Partial Distance Search (VIPDS) kNN. The FkNN was implemented and tested on CICIDS2017 in terms of accuracy and computational time.…”

Machine learning to improve the performance of anomaly-based network intrusion detection in big data

“…This uneven structure must be formulated, as evidenced by the system's efficiency. To address the problem of classimbalanced data, which frequently leads to a low rate of anomaly detection, random oversampling and synthetic minority oversampling technique (SMOTE) are used [41], which typically results in a low anomaly detection rate can be used to generate additional data in minority classes where there is a scarcity of data [12]. 𝐼𝑚𝑏𝑎𝑙𝑎𝑛𝑐𝑒𝑅𝑎𝑡𝑖𝑜 = 𝑚𝑎𝑥 𝑖 {𝑥 𝑖 } 𝑚𝑖𝑛 𝑖 {𝑥 𝑖 } may be used to compute the imbalanced ratio, which can then be utilized as the matrices [42].…”

“…As an evaluation, use a more realistic IDS and a current security dataset with real network traffic CSE-CIC-IDS-2018 for a wide range of intrusions and normal behavior. The CSE-CIC-IDS-2018 dataset is big data, associated with specific properties, such as volume, variety, velocity, variability, value, and complexity [12], [13]. The term "volume" refers to the amount of data present.…”