Anomaly network-based intrusion detection system using a reliable hybrid artificial bee colony and AdaBoost algorithms

Mazini, Mehrnaz; Shirazi, Babak; Mahdavi, Iraj

doi:10.1016/j.jksuci.2018.03.011

Cited by 165 publications

(86 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The latency between an intrusion and its detection represents the main disadvantages, as well as the high number of misidentifications of normal (false positive) and intrusions (false negative) events. • Network-based [64]: A Network-based Intrusion Detection System (NIDS) operates by capturing and analyzing the whole network activities ( Figure 3). Each activity is then compared to the signatures stored in a database and related to known events (normal and intrusion), and only the unknown signatures will be analyzed.…”

Section: Operative Placementmentioning

confidence: 99%

A Local Feature Engineering Strategy to Improve Network Anomaly Detection

et al. 2020

View full text Add to dashboard Cite

The dramatic increase in devices and services that has characterized modern societies in recent decades, boosted by the exponential growth of ever faster network connections and the predominant use of wireless connection technologies, has materialized a very crucial challenge in terms of security. The anomaly-based intrusion detection systems, which for a long time have represented some of the most efficient solutions to detect intrusion attempts on a network, have to face this new and more complicated scenario. Well-known problems, such as the difficulty of distinguishing legitimate activities from illegitimate ones due to their similar characteristics and their high degree of heterogeneity, today have become even more complex, considering the increase in the network activity. After providing an extensive overview of the scenario under consideration, this work proposes a Local Feature Engineering (LFE) strategy aimed to face such problems through the adoption of a data preprocessing strategy that reduces the number of possible network event patterns, increasing at the same time their characterization. Unlike the canonical feature engineering approaches, which take into account the entire dataset, it operates locally in the feature space of each single event. The experiments conducted on real-world data showed that this strategy, which is based on the introduction of new features and the discretization of their values, improves the performance of the canonical state-of-the-art solutions.

show abstract

Section: Operative Placementmentioning

confidence: 99%

A Local Feature Engineering Strategy to Improve Network Anomaly Detection

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Luego en la clasificación, la predicción se realiza en base a un esquema de votación ponderado, dando mayor peso en la votación a aquellos clasificadores base con un mayor acierto sobre el conjunto de entrenamiento. Este método adaptativo se ha empleado en la detección de anomalías [42], donde su combinación con un algoritmo evolutivo muestra que puede ser una estrategia competitiva con respecto al estado-del arte [43].…”

Section: Materiales Y Métodosunclassified

Esquemas de combinación de árboles de decisión como estrategia para la detección de anomalías

Quintana-Zaez¹,

Velarde-Bedregal²,

Anton-Vargas³

et al. 2020

Proceedings of the 18th LACCEI International Multi-Conference for Engineering, Education, and Technology: Engineering, Integrat

View full text Add to dashboard Cite

Security of the data consumed, generated and stored is crucial to the quality of life in today's society. For this reason, this paper proposes a comparative study of different combination schemes of multiple classifiers based on decision trees, due to its scalability and easy implementation. As a result, precision and recall values of about 97% and 100% were obtained, showing their high reliability, reducing false alarms and high generalization capacity. A comparison with a deep learning based algorithm showed that tree combination strategies are competitive and with statistically similar and superior results to the state-of-the-art. In the end, the results suggest that adaptive strategies such as XGBoost or highly randomized strategies such as Random Forest or Extra-Tree can be alternatives for the protection of precious data on the network.

show abstract

“…It is observed that the proposed technique is top performer than other considered methods. Mazini et al proposed a hybrid approach for anomaly network‐based IDS (A‐NIDS), which used the Artificial Bee Colony (ABC) for feature selection and AdaBoost for low FPR and high DR. Handling massive data is a big challenge for Network Intrusion detection system. Ramachandran et al proposes a two‐pronged strategy for agent‐based intrusion detection which can be applicable on power‐aware ad‐hoc networks.…”

Section: Related Workmentioning

confidence: 99%

Statistical vertical reduction‐based data abridging technique for big network traffic dataset

Garg

Singh

Obaidat

et al. 2019

Int J Communication

View full text Add to dashboard Cite

Summary Security is the major concern in the world of Internet. Traditionally, encryption, firewall, and other security countermeasures are used to secure the data. However, in the modern era of technology, the Intrusion Detection System (IDS) plays a major role in the field of security to detect the attack type. IDS are tuned in such a way that it learns from historical network traffic data and detects normal as well as abnormal event connection from the monitored system. Nevertheless, due to the huge size of historical data, this system can suffer from issues like accuracy, false alarms and execution time. In this paper, a new abridging algorithm is proposed, which is able to vertically reduce the size of network traffic dataset without affecting its statistical characteristics. In the literature, vertical data reduction i.e. features selection techniques are always used to reduce dataset, but this paper evaluates the effect of vertical reduction, which has not been examined significantly. Apart from abridging of vertical instances, Infinite Feature Selection technique is used to extract the relevant features from the dataset and Support Vector Machine classifier is used to classify normal and anomalous instances. The performance of the proposed system is evaluated on different datasets like NSL‐KDD and Kyoto University benchmark dataset using various parameters like accuracy, the number of instances reduced, recall, precision, f1‐score, t‐value and execution time.

show abstract

Anomaly network-based intrusion detection system using a reliable hybrid artificial bee colony and AdaBoost algorithms

Cited by 165 publications

References 17 publications

A Local Feature Engineering Strategy to Improve Network Anomaly Detection

A Local Feature Engineering Strategy to Improve Network Anomaly Detection

Esquemas de combinación de árboles de decisión como estrategia para la detección de anomalías

Statistical vertical reduction‐based data abridging technique for big network traffic dataset

Contact Info

Product

Resources

About