An Analysis of the KDD99 and UNSW-NB15 Datasets for the Intrusion Detection System

Al-Daweri, Muataz Salam; Ariffin, Khairul Akram Zainol; Abdullah, Salwani; Senan, Mohamad Firham Efendy Md

doi:10.3390/sym12101666

Cited by 66 publications

(31 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While the model proposed by Koroniotis et al (2017) achieved 93.23% accuracy using DT classifier. In addition, none of the studies listed in Table 1 have resolved the class imbalance problem of the UNSW-NB15 dataset as there are many studies ( Al-Daweri et al, 2020 ; Ahmad et al, 2021 ; Bagui & Li, 2021 ; Dlamini & Fahim, 2021 ) that have highlighted this issue. We addressed the class imbalance problem by applying SMOTE that improved the performance of the classifiers and achieved good results.…”

Section: Discussionmentioning

confidence: 99%

Network intrusion detection using oversampling technique and machine learning algorithms

Ahmed¹,

Hameed²,

Bawany³

2022

PeerJ Computer Science

View full text Add to dashboard Cite

The expeditious growth of the World Wide Web and the rampant flow of network traffic have resulted in a continuous increase of network security threats. Cyber attackers seek to exploit vulnerabilities in network architecture to steal valuable information or disrupt computer resources. Network Intrusion Detection System (NIDS) is used to effectively detect various attacks, thus providing timely protection to network resources from these attacks. To implement NIDS, a stream of supervised and unsupervised machine learning approaches is applied to detect irregularities in network traffic and to address network security issues. Such NIDSs are trained using various datasets that include attack traces. However, due to the advancement in modern-day attacks, these systems are unable to detect the emerging threats. Therefore, NIDS needs to be trained and developed with a modern comprehensive dataset which contains contemporary common and attack activities. This paper presents a framework in which different machine learning classification schemes are employed to detect various types of network attack categories. Five machine learning algorithms: Random Forest, Decision Tree, Logistic Regression, K-Nearest Neighbors and Artificial Neural Networks, are used for attack detection. This study uses a dataset published by the University of New South Wales (UNSW-NB15), a relatively new dataset that contains a large amount of network traffic data with nine categories of network attacks. The results show that the classification models achieved the highest accuracy of 89.29% by applying the Random Forest algorithm. Further improvement in the accuracy of classification models is observed when Synthetic Minority Oversampling Technique (SMOTE) is applied to address the class imbalance problem. After applying the SMOTE, the Random Forest classifier showed an accuracy of 95.1% with 24 selected features from the Principal Component Analysis method.

show abstract

Section: Discussionmentioning

confidence: 99%

Network intrusion detection using oversampling technique and machine learning algorithms

Ahmed¹,

Hameed²,

Bawany³

2022

PeerJ Computer Science

View full text Add to dashboard Cite

show abstract

“…The Kaggle version of the KDD Cup 99 [30], [31] is available an online dataset. The dataset is composed by a total of 25192 TCP/IP connections (observations) from a simulated typical US Air Force LAN.…”

Section: A Kdd99mentioning

confidence: 99%

Design and Testing Novel One-Class Classifier Based on Polynomial Interpolation With Application to Networking Security

Dini

Begni

Ciavarella³

et al. 2022

IEEE Access

View full text Add to dashboard Cite

This work exploits the concept of one-class classifier applied to the problem of anomaly detection in communication networks. The article presents the design of an innovative anomaly detection algorithm based on polynomial interpolation technique and statistical analysis. The innovative method is applied to datasets largely used in the scientific community for bench-marking such as KDD99, UNSW-NB15 and CSE-CIC-IDS-2018, and further evaluated with application to a novel available dataset EDGE-IIOTSET 2022. The paper also reports experimental results showing that the proposed methodology outperforms classic one-class classifiers, such as Extreme Learning Machine and Support Vector Machine models, and rule-based intrusion detection system like SNORT. With respect to binary classifiers, this work has the advantage of not requiring any a-priori knowledge about attacks and is based on the collection of only normal data traffic.

show abstract

“…There are a number of attractive datasets for network intrusion detection investigating. For instance, KDD 99 is one of the most utilized in studying network IDS [12,47,75]. The KDD 99 is public, that is a benchmark to evaluate performance between provided approached.…”

Section: Lack Of Dedicated Apt Network Intrusion Datasetmentioning

confidence: 99%

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

et al. 2022

View full text Add to dashboard Cite

Despite its technological benefits, Internet of Things (IoT) has cyber weaknesses due to the vulnerabilities in the wireless medium. Machine learning (ML)-based methods are widely used against cyber threats in IoT networks with promising performance. Advanced persistent threat (APT) is prominent for cybercriminals to compromise networks, and it is crucial to long-term and harmful characteristics. However, it is difficult to apply ML-based approaches to identify APT attacks to obtain a promising detection performance due to an extremely small percentage among normal traffic. There are limited surveys to fully investigate APT attacks in IoT networks due to the lack of public datasets with all types of APT attacks. It is worth to bridge the state-of-the-art in network attack detection with APT attack detection in a comprehensive review article. This survey article reviews the security challenges in IoT networks and presents the well-known attacks, APT attacks, and threat models in IoT systems. Meanwhile, signature-based, anomaly-based, and hybrid IDSs are summarized for IoT networks. The article highlights statistical insights regarding frequently applied ML-based methods against network intrusion. Finally, open issues and challenges for common network intrusion and APT attacks are presented for future research.

show abstract

An Analysis of the KDD99 and UNSW-NB15 Datasets for the Intrusion Detection System

Cited by 66 publications

References 34 publications

Network intrusion detection using oversampling technique and machine learning algorithms

Network intrusion detection using oversampling technique and machine learning algorithms

Design and Testing Novel One-Class Classifier Based on Polynomial Interpolation With Application to Networking Security

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

Contact Info

Product

Resources

About