Analysis, Design, and Comparison of Machine-Learning Techniques for Networking Intrusion Detection

Abstract

The use of machine-learning techniques is becoming more and more frequent in solving all those problems where it is difficult to rationally interpret the process of interest. Intrusion detection in networked systems is a problem in which, although it is not fundamental to interpret the measures that one is able to obtain from a process, it is important to obtain an answer from a classification algorithm if the network traffic is characterized by anomalies (and hence, there is a high probability of an intrusion) or not. Due to the increased adoption of SW-defined autonomous systems that are distributed and interconnected, the probability of a cyber attack is increased, as well as its consequence in terms of system reliability, availability, and even safety. In this work, we present the application of different machine-learning models to the problem of anomaly classification in the context of local area network (LAN) traffic analysis. In particular, we present the application of a K-nearest neighbors (KNN) and of an artificial neural network (ANN) to realize an algorithm for intrusion detection systems (IDS). The dataset used in this work is representative of the communication traffic in common LAN networks in military application in particular typical US Air Force LAN. This work presents a training phase of the different models based on a multidimensional-scaling preprocessing procedure, based on different metrics, to provide higher performance and generalization with respect to model prediction capability. The obtained results of KNN and ANN classifiers are compared with respect to a commonly used index of performance for classifiers evaluation.

Design and Testing Novel One-Class Classifier Based on Polynomial Interpolation With Application to Networking Security

“…Some recent works as [1]- [3] use the ML and AIbased methodologies to explore the various ways of detecting malicious attacks in the computer's networks. In other works in literature for cybercrime [4]- [7], it has been already demonstrated that ML and AI-based methodologies have the potentiality to outperform rules-based IDS tools, such as SNORT and WIRE-SHARK. This is mainly due to the flexibility of ML/AI models.…”

“…In addition, many works limit themselves to testing their algorithms on a single dataset, limiting the validity of the achieved results. For example, in [4], the authors mainly analysed the problem of binary classification on a single dataset. This obviously requires a priori knowledge of anomalous and normal traffic.…”

“…This knowledge is not always easy to access. Furthermore, previous Anomaly and Intrusion Detection approaches [4]- [7], [9]- [16] can be easily bypassed by new attack techniques. Few works propose the use of one-class models, and even fewer propose a comparison across multiple datasets, as we propose in this paper.…”

Toward Resilience in Mixed Critical Industrial Control Systems: A Multi-Disciplinary View

“…In this context, mixed criticality comes into play by defining different constraints and thresholds on tolerated faults for the diverse network participants, e.g., see [34]. Further techniques include one-class classifiers, which can detect anomalies in communication systems [37], and machine learning, e.g., for intrusion detection [38].…”

Hybrid GrabCut Hidden Markov Model for Segmentation

“…It is assumed in this algorithm that in multidimensional space, every instance resembles other points. The Euclidean distance is used to evaluate the nearest neighbor of any instance along with recalculating the new group "k" points [4,5]. To find the nearest distance, we repeat this strategy until the "k" point selection.…”