A Real Time Adaptive Intrusion Detection Alert Classifier for High Speed Networks

Sallay, Hassen; Ammar, Adel; Saad, Majdi Ben; Bourouis, Sami

doi:10.1109/nca.2013.16

Cited by 26 publications

(17 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moreover, the FAR is lower than the FAR of other studies. The DR of attacks is 68%, which is very low according to [44]- [46], in which the DRs are greater than 90%. However, it should be noted that the comparisons in Table 20 cannot be trusted because they are not conducted on the same part of the ISCX dataset.…”

Section: Hybrid Model and Experimental Resultsmentioning

confidence: 99%

Design of Multilevel Hybrid Classifier with Variant Feature Sets for Intrusion Detection System

Akyol

Hacıbeyoğlu

Karlık

2016

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYWith the increase of network components connected to the Internet, the need to ensure secure connectivity is becoming increasingly vital. Intrusion Detection Systems (IDSs) are one of the common security components that identify security violations. This paper proposes a novel multilevel hybrid classifier that uses different feature sets on each classifier. It presents the Discernibility Function based Feature Selection method and two classifiers involving multilayer perceptron (MLP) and decision tree (C4.5). Experiments are conducted on the KDD'99 Cup and ISCX datasets, and the proposal demonstrates better performance than individual classifiers and other proposed hybrid classifiers. The proposed method provides significant improvement in the detection rates of attack classes and Cost Per Example (CPE) which was the primary evaluation method in the KDD'99

show abstract

Section: Hybrid Model and Experimental Resultsmentioning

confidence: 99%

Design of Multilevel Hybrid Classifier with Variant Feature Sets for Intrusion Detection System

Akyol

Hacıbeyoğlu

Karlık

2016

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…Benchmarking KDD'99 and ISCX datasets, accuracy is reached at 98.03% and 99.5%, and false alarm rate is reached at 5.71% and 0.03%, respectively. In Sallay et al, support vector machine (SVM) algorithm is introduced as a real‐time, efficient, and adaptable system at performing detection of new alerts in high‐speed networks. Testing with three datasets gives 0.30 false alarm rate requiring improvement in adaptability.…”

Section: Related Workmentioning

confidence: 99%

A deep learning method to detect network intrusion through flow‐based features

Pektaş

Acarman

2018

Int J Network Mgmt

View full text Add to dashboard Cite

In this paper, we present a deep neural network model to enhance the intrusion detection performance. A deep learning architecture combining convolution neural network and long short-term memory learns spatial-temporal features of network flows automatically. Flow features are extracted from raw network traffic captures, flows are grouped, and the consecutive N flow records are transformed into a two-dimensional array like an image. These constructed two-dimensional feature vectors are normalized and forwarded to the deep learning model. Transformation of flow information assures deep learning in a computationally efficient manner. Overall, convolution neural network learns spatial features, and long short-term memory learns temporal features from a sequence of network raw data packets. To maximize the detection performance of the deep neural network and to reach at the highest statistical metric values, we apply the tree-structured Parzen estimator seeking the optimum parameters in the parameter hyper-plane. Furthermore, we investigate the impact of flow status interval, flow window size, convolution filter size, and long short-term memory units to the detection performance in terms of level in statistical metric values. The presented flow-based intrusion method outperforms other publicly available methods, and it detects abnormal traffic with 99.09% accuracy and 0.0227 false alarm rate. INTRODUCTIONNetwork security requires automatic detection of network attacks and learning capability to maintain the integrity and operation of the network. To detect and react to network security attacks, a well trained and tested intrusion detection system (IDS) is mandatory. The IDS systems are classified into two groups: network-based IDS, which monitors network traffic to detect intrusion attempt, and host-based IDS, which analyzes system and software logs, file system, disk activities, etc, to identify abnormal behavior. Then, misuse detection and anomaly detection identify attacks by matching patterns of known instructions and deviations from normal traffic, respectively. Generally, these two groups adopt different approaches and are used in harmony to ensure security.Along with the increasing levels of connectivity including the adoption of cloud-based services and Internet of Things, web-based services, the volume of network data is drastically growing. Former rule-based systems cannot respond to massive network data, and they are not responsive to newly created attacks based on the former rules identified or updated by security analysts. Security hole without available fix or signature is a major threat to the network. Machine learning algorithms are an intermediate solution at identifying types of attacks, and the expertise of security analysts or system Int J Network Mgmt. 2019;29:e2050.wileyonlinelibrary.com/journal/nem

show abstract

“…This feature extraction method suggested 11 important features from all the features. A similar feature extraction mechanism was used in [20], where they used the same extracted features. However, in our work we did an essential change by creating a new feature called "duration", which contains the same result which is obtained from combining two features "startDateTime" and "stopDateTime".…”

Section: Intrusion Dataset Pre-processingmentioning

confidence: 99%