Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic

Abstract

The consolidation of encryption and big data in network communications have made deep packet inspection no longer feasible in large networks. Early attack detection requires feature vectors which are easy to extract, process, and analyze, allowing their generation also from encrypted traffic. So far, experts have selected features based on their intuition, previous research, or acritically assuming standards, but there is no general agreement about the features to use for attack detection in a broad scope. We compared five lightweight feature sets that have been proposed in the scientific literature for the last few years, and evaluated them with supervised machine learning. For our experiments, we use the UNSW-NB15 dataset, recently published as a new benchmark for network security. Results showed three remarkable findings: (1) Analysis based on source behavior instead of classic flow profiles is more effective for attack detection; (2) meta-studies on past research can be used to establish satisfactory benchmarks; and (3) features based on packet length are clearly determinant for capturing malicious activity. Our research showed that vectors currently used for attack detection are oversized, their accuracy and speed can be improved, and are to be adapted for dealing with encrypted traffic.

An Analysis of the KDD99 and UNSW-NB15 Datasets for the Intrusion Detection System

“…1.6 × 10 +1 9.1 × 10 −5 0.0 × 10 +0 0.0 × 10 +0 9.4 × 10 +2 1.6 × 10 −2 9.4 × 10 +2 1.6 × 10 −2 2.0 × 10 +0 2.9 × 10 −5 f 2-39 7.4 × 10 +1 4.2 × 10 −4 4.8 × 10 +1 6.4 × 10 −4 7.1 × 10 +1 1.2 × 10 −3 7.0 × 10 +1 1.2 × 10 −3 4.8 × 10 +1 7.0 × 10 −4 f 2- 40 3.3 × 10 +3 1.9 × 10 −2 7.7 × 10 +1 1.0 × 10 −3 1.3 × 10 +2 2.3 × 10 −3 1.2 × 10 +2 2.2 × 10 −3 7.2 × 10 +1 1.0 × 10 −3 f 2- 41 3.0 × 10 +3 1.7 × 10 −2 3.3 × 10 +2 4.5 × 10 −3 2.3 × 10 +3 3.9 × 10 −2 2.3 × 10 +3 3.9 × 10 −2 2.0 × 10 +3 3.0 × 10 −2 f 2-42 2.7 × 10 +3 1.5 × 10 −2 2.7 × 10 +3 3.7 × 10 −2 2.7 × 10 +3 4.7 × 10 −2 2.7 × 10 +3 4.7 × 10 −2 2.7 × 10 +3 4.0 × 10 −2 3.6 × 10 +4 4.0 × 10 −1 4.2 × 10 +4 4.4 × 10 −1 3.6 × 10 +4 5.5 × 10 −1 4.3 × 10 +4 7.6 × 10 −1 5.1 × 10 +4 9.1 × 10 −1 f 2-10…”

“…A correlation-based approach was implemented, to reduce the features from the datasets. Reference [40] examined the reliability of a few machine learning models, such as the RF and gradient-boosting machines in real-world IoT settings. In order to do the examination, data-poisoning attacks were simulated by using a stochastic function to modify the training data of the datasets.…”

Walling up Backdoors in Intrusion Detection Systems

“…For processing the data, we base our analysis on the CAIA [18] feature vector as formulated in [9], which includes the used protocol, flow duration, packet count and the total number of transmitted bytes, the minimum, maximum, mean and standard deviation of packet length and inter-arrival time and the number of packets with specific TCP flags set.…”

“…In this paper, we train models to detect network attacks similar to the approach of a recent paper [9], which bases on the UNSW-NB15 dataset [10] and evaluates the performance of several feature vectors and ML techniques for accurate AD in the context of IDSs. We then add a backdoor to the models and show that attack detection can efficiently be bypassed if the attacker had the ability to modify training data.…”

Network Based Intrusion Detection Using the UNSW-NB15 Dataset

“…Backdoor). Similarly, [25] experimented with Random forests after careful data-preprocessing using principal component analysis. Their results showcases a Precision and Recall of respectively 84.9% and 85.1%.…”