Comparative analysis of Machine Learning algorithms for Intrusion Detection

Pai, Vasudeva; Devidas,; Adesh, N. D.

doi:10.1088/1757-899x/1013/1/012038

Cited by 14 publications

(5 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Table 3.1. Illustrate the Distribution of instances in NSL-KDD dataset for training and testing [23]. Each instance in the dataset displays 41 continuous and discrete attributes (38 numerical and 3 symbolic), to more details [24,25].…”

Section: Datasetsmentioning

confidence: 99%

Hybrid AE-MLP: Hybrid Deep Learning Model Based on Autoencoder and Multilayer Perceptron Model for Intrusion Detection System

2023

IJIES

View full text Add to dashboard Cite

Network violations are currently society's major challenge. For networks to be protected against hostile threats, an intrusion detection system (IDS) is important. To create effective IDS, deep learning (DL) is used in various fields, including information security. In this paper, a hybrid deep learning approach is proposed to effectively identify network intrusions using Autoencoder (AE) and Multi-layer perceptron (MLP). We use Autoencoder which can reduce the number of the original attributes based on the number of attributes, we first enter the original data on the Autoencoder and produce new compressed data, then enter it on the MLP classifier. The NSL-KDD dataset is thoroughly evaluated to determine the efficacy of the hybrid AE-MLP model the best outcomes are reached, with an accuracy rate of 87.6% and 81.06% (binary classification and multi-classification). In addition, the proposed hybrid method was compared with various recently proposed DL-based attack detection mechanisms. In terms of performance on the available dataset, it is observed that the proposed model outperformed.

show abstract

Section: Datasetsmentioning

confidence: 99%

Hybrid AE-MLP: Hybrid Deep Learning Model Based on Autoencoder and Multilayer Perceptron Model for Intrusion Detection System

2023

IJIES

View full text Add to dashboard Cite

show abstract

“…Supervised ML algorithms are widely used in computer network traffic analysis. The performance evaluation and comparative analysis of supervised ML used in classification are presented in [11,[27][28][29][30][31][32].…”

Section: Related Workmentioning

confidence: 99%

“…However, since the differences were small, the authors concluded that either model could be used. Performance evaluation and comparative analysis of FNN, SVM, DT, k-NN and wk-NN classifiers can be found in [3,17,28,[31][32][33][34][35][36][37][38][39][40].…”

Section: Related Workmentioning

confidence: 99%

Cybersecurity in Smart Cities: Detection of Opposing Decisions on Anomalies in the Computer Network Behavior

et al. 2022

View full text Add to dashboard Cite

The increased use of urban technologies in smart cities brings new challenges and issues. Cyber security has become increasingly important as many critical components of information and communication systems depend on it, including various applications and civic infrastructures that use data-driven technologies and computer networks. Intrusion detection systems monitor computer networks for malicious activity. Signature-based intrusion detection systems compare the network traffic pattern to a set of known attack signatures and cannot identify unknown attacks. Anomaly-based intrusion detection systems monitor network traffic to detect changes in network behavior and identify unknown attacks. The biggest obstacle to anomaly detection is building a statistical normality model, which is difficult because a large amount of data is required to estimate the model. Supervised machine learning-based binary classifiers are excellent tools for classifying data as normal or abnormal. Feature selection and feature scaling are performed to eliminate redundant and irrelevant data. Of the 24 features of the Kyoto 2006+ dataset, nine numerical features are considered essential for model training. Min-Max normalization in the range [0,1] and [−1,1], Z-score standardization, and new hyperbolic tangent normalization are used for scaling. A hyperbolic tangent normalization is based on the Levenberg-Marquardt damping strategy and linearization of the hyperbolic tangent function with a narrow slope gradient around zero. Due to proven classification ability, in this study we used a feedforward neural network, decision tree, support vector machine, k-nearest neighbor, and weighted k-nearest neighbor models Overall accuracy decreased by less than 0.1 per cent, while processing time was reduced by more than a two-fold reduction. The results show a clear benefit of the TH scaling regarding processing time. Regardless of how accurate the classifiers are, their decisions can sometimes differ. Our study describes a conflicting decision detector based on an XOR operation performed on the outputs of two classifiers, the fastest feedforward neural network, and the more accurate but slower weighted k-nearest neighbor model. The results show that up to 6% of different decisions are detected.

show abstract

“…In order to determine the statistical model of an anomalybased IDS, various approaches used a number of assumptions about the training data and validation methods. To classify network traffic, the authors of [6][7][8][9] present a comparative analyses and performance evaluation of multiple supervised ML algorithms. The most widely used supervised ML models including SVM [3][4][5], Naïve Bayes (NB) [6,7], DT [7,8], nearest neighbors [9][10][11], random forest (RF) [6,7,12], artificial neural networks (ANN) [7,10,13], logistic regression (LR) [6,7], discriminant analysis (DA) [9], and ensemble methods (EM) [14][15][16] were analyzed.…”

Section: Introductionmentioning

confidence: 99%

Numerical Feature Selection and Hyperbolic Tangent Feature Scaling in Machine Learning-Based Detection of Anomalies in the Computer Network Behavior

Protić,

Stanković,

Prodanović

et al. 2023

Electronics

View full text Add to dashboard Cite

Anomaly-based intrusion detection systems identify the computer network behavior which deviates from the statistical model of typical network behavior. Binary classifiers based on supervised machine learning are very accurate at classifying network data into two categories: normal traffic and anomalous activity. Most problems with supervised learning are related to the large amount of data required to train the classifiers. Feature selection can be used to reduce datasets. The goal of feature selection is to select a subset of relevant input features to optimize the evaluation and improve performance of a given classifier. Feature scaling normalizes all features to the same range, preventing the large size of features from affecting classification models or other features. The most commonly used supervised machine learning models, including decision trees, support vector machine, k-nearest neighbors, weighted k-nearest neighbors and feedforward neural network, can all be improved by using feature selection and feature scaling. This paper introduces a new feature scaling technique based on a hyperbolic tangent function and damping strategy of the Levenberg–Marquardt algorithm.

show abstract

Comparative analysis of Machine Learning algorithms for Intrusion Detection

Cited by 14 publications

References 5 publications

Hybrid AE-MLP: Hybrid Deep Learning Model Based on Autoencoder and Multilayer Perceptron Model for Intrusion Detection System

Hybrid AE-MLP: Hybrid Deep Learning Model Based on Autoencoder and Multilayer Perceptron Model for Intrusion Detection System

Cybersecurity in Smart Cities: Detection of Opposing Decisions on Anomalies in the Computer Network Behavior

Numerical Feature Selection and Hyperbolic Tangent Feature Scaling in Machine Learning-Based Detection of Anomalies in the Computer Network Behavior

Contact Info

Product

Resources

About