A Review of Machine Learning Methodologies for Network Intrusion Detection

Phadke, Aditya; Kulkarni, Mohit Rameshchandra; Bhawalkar, Pranav; Bhattad, Rashmi

doi:10.1109/iccmc.2019.8819748

Cited by 31 publications

(16 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This section recalls the works [7][8][9][10][11][12][13][14][15][16][17][18][19][20] from which inspiration was taken for the application of ML models and to make a comparison between the state-of-the-art results and the results achieved by the techniques we presented in the next sections.…”

Section: Related Workmentioning

confidence: 99%

“…The review in [7] intends to provide an exhaustive survey of the currently proposed ML-based intrusion detection systems to assist network intrusion detection system developers to gain a better intuition. The usefulness of this paper is to summarize the fundamental concept of ML and the intrusion detection problem, but in fact it does not present an innovative method or operational procedure of learning-model design as it is done in next sections of our paper.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Analysis, Design, and Comparison of Machine-Learning Techniques for Networking Intrusion Detection

Dini

Saponara

2021

Designs

View full text Add to dashboard Cite

The use of machine-learning techniques is becoming more and more frequent in solving all those problems where it is difficult to rationally interpret the process of interest. Intrusion detection in networked systems is a problem in which, although it is not fundamental to interpret the measures that one is able to obtain from a process, it is important to obtain an answer from a classification algorithm if the network traffic is characterized by anomalies (and hence, there is a high probability of an intrusion) or not. Due to the increased adoption of SW-defined autonomous systems that are distributed and interconnected, the probability of a cyber attack is increased, as well as its consequence in terms of system reliability, availability, and even safety. In this work, we present the application of different machine-learning models to the problem of anomaly classification in the context of local area network (LAN) traffic analysis. In particular, we present the application of a K-nearest neighbors (KNN) and of an artificial neural network (ANN) to realize an algorithm for intrusion detection systems (IDS). The dataset used in this work is representative of the communication traffic in common LAN networks in military application in particular typical US Air Force LAN. This work presents a training phase of the different models based on a multidimensional-scaling preprocessing procedure, based on different metrics, to provide higher performance and generalization with respect to model prediction capability. The obtained results of KNN and ANN classifiers are compared with respect to a commonly used index of performance for classifiers evaluation.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Analysis, Design, and Comparison of Machine-Learning Techniques for Networking Intrusion Detection

Dini

Saponara

2021

Designs

View full text Add to dashboard Cite

show abstract

“…However, a method that relies on patterns for existing attacks has a disadvantage in that it is impossible to detect an attack that is not known beforehand, and the network is easily penetrated by a variant of an existing attack. To solve this problem, various methods have been proposed and applied to the NIDS [6] [7]. The machine learning-based NIDS (ML-NIDS), which has recently received the most attention, was evaluated as an alternative that can significantly improve the shortcomings of the pattern matching NIDS (PM-NIDS).…”

Section: Introductionmentioning

confidence: 99%

Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification

Kim

Pak

2022

IEEE Access

View full text Add to dashboard Cite

Network Intrusion Detection Systems (NIDSs) using pattern matching have a fatal weakness in that they cannot detect new attacks because they only learn existing patterns and use them to detect those attacks. To solve this problem, a machine learning-based NIDS (ML-NIDS) that detects anomalies through ML algorithms by analyzing behaviors of protocols. However, the ML-NIDS learns the characteristics of attack traffic based on training data, so it, too, is inevitably vulnerable to attacks that have not been learned, just like pattern-matching machine learning. Therefore, in this study, by analyzing the characteristics of learning using representative features, we show that network intrusion outside the scope of the learned data in the feature space can bypass the ML-NIDS. To prevent this, designing the active session to be classified early, before it goes outside the detection range of the training dataset of the ML-NIDS, can effectively prevent bypassing the ML-NIDS. Various experiments confirmed that the proposed method can detect intrusion sessions early (before sessions terminate) significantly improving the robustness of the existing ML-NIDS. The proposed approach can provide more robust and more accurate classification with the same classification datasets compared to existing approaches, so we expect it will be used as one of feasible solutions to overcome weakness and limitation of existing ML-NIDSs.

show abstract

“…Machine Learning (ML) techniques widely used in computer security data sets have recently become a trend in security technology [13]. It contributes to analyses and handling the massive amount of data and extracts the essential features that are used in various techniques for feature selection [14]. IDS is a commonly used machine learning classifier to distinguish between various attacks as a class [15].…”

Section: Introductionmentioning

confidence: 99%

Evaluation of Classification Algorithms for Intrusion Detection System: A Review

Salih

Abdulazeez

2021

JSCDM

View full text Add to dashboard Cite

Intrusion detection is one of the most critical network security problems in the technology world. Machine learning techniques are being implemented to improve the Intrusion Detection System (IDS). In order to enhance the performance of IDS, different classification algorithms are applied to detect various types of attacks. Choosing a suitable classification algorithm for building IDS is not an easy task. The best method is to test the performance of the different classification algorithms. This paper aims to present the result of evaluating different classification algorithms to build an IDS model in terms of confusion matrix, accuracy, recall, precision, f-score, specificity and sensitivity. Nevertheless, most researchers have focused on the confusion matrix and accuracy metric as measurements of classification performance. It also provides a detailed comparison with the dataset, data preprocessing, number of features selected, feature selection technique, classification algorithms, and evaluation performance of algorithms described in the intrusion detection system.

show abstract

A Review of Machine Learning Methodologies for Network Intrusion Detection

Cited by 31 publications

References 6 publications

Analysis, Design, and Comparison of Machine-Learning Techniques for Networking Intrusion Detection

Analysis, Design, and Comparison of Machine-Learning Techniques for Networking Intrusion Detection

Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification

Evaluation of Classification Algorithms for Intrusion Detection System: A Review

Contact Info

Product

Resources

About