Concept Drift Analysis by Dynamic Residual Projection for Effectively Detecting Botnet Cyber-Attacks in IoT Scenarios

Qiao, Hanli; Novikov, Boris; Blech, Jan Olaf

doi:10.1109/tii.2021.3108464

Cited by 22 publications

(17 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Schwengber et al [15] proposed unsupervised botnet detection that can detect botnet attacks in the network traffic that exhibits concept drift. The system presents non-linear discriminative concept drift identification, an unsupervised approach for detecting concept drift in streaming network traffic data.…”

Section: Botnet Attack Detection In Network Traffic Streams With Conc...mentioning

confidence: 99%

An Adaptive Scalable Data Pipeline for Multiclass Attack Classification in Large-Scale IoT Networks

Saravanan,

Balasubramanian

2024

Big Data Min. Anal.

View full text Add to dashboard Cite

The current large-scale Internet of Things (IoT) networks typically generate high-velocity network traffic streams. Attackers use IoT devices to create botnets and launch attacks, such as DDoS, Spamming, Cryptocurrency mining, Phishing, etc. The service providers of large-scale IoT networks need to set up a data pipeline to collect the vast network traffic data from the IoT devices, store it, analyze it, and report the malicious IoT devices and types of attacks. Further, the attacks originating from IoT devices are dynamic, as attackers launch one kind of attack at one time and another kind of attack at another time. The number of attacks and benign instances also vary from time to time. This phenomenon of change in attack patterns is called concept drift. Hence, the attack detection system must learn continuously from the ever-changing real-time attack patterns in large-scale IoT network traffic. To meet this requirement, in this work, we propose a data pipeline with Apache Kafka, Apache Spark structured streaming, and MongoDB that can adapt to the ever-changing attack patterns in real time and classify attacks in large-scale IoT networks. When concept drift is detected, the proposed system retrains the classifier with the instances that cause the drift and a representative subsample instances from the previous training of the model. The proposed approach is evaluated with the latest dataset, IoT23, which consists of benign and several attack instances from various IoT devices. Attack classification accuracy is improved from 97.8% to 99.46% by the proposed system. The training time of distributed random forest algorithm is also studied by varying the number of cores in Apache Spark environment.

show abstract

Section: Botnet Attack Detection In Network Traffic Streams With Conc...mentioning

confidence: 99%

An Adaptive Scalable Data Pipeline for Multiclass Attack Classification in Large-Scale IoT Networks

Saravanan,

Balasubramanian

2024

Big Data Min. Anal.

View full text Add to dashboard Cite

show abstract

“…It also applies game theory of cooperative combination. Qiao et al [7] presented how the concept drift analysis based on dynamic residual projection can prevent botnet attacks. Using a subdataset of the Bot-IoT dataset, the proposed approach was able to achieve superior performance.…”

Section: Integrated ML Approachesmentioning

confidence: 99%

Leveraging Graph-Based Representations to Enhance Machine Learning Performance in IIoT Network Security and Attack Detection

et al. 2023

View full text Add to dashboard Cite

In the dynamic and ever-evolving realm of network security, the ability to accurately identify and classify portscan attacks both inside and outside networks is of paramount importance. This study delves into the underexplored potential of fusing graph theory with machine learning models to elevate their anomaly detection capabilities in the context of industrial Internet of things (IIoT) network data analysis. We employed a comprehensive experimental approach, encompassing data preprocessing, visualization, feature analysis, and machine learning model comparison, to assess the efficacy of graph theory representation in improving classification accuracy. More specifically, we converted network traffic data into a graph-based representation, where nodes represent devices and edges represent communication instances. We then incorporated these graph features into our machine learning models. Our findings reveal that incorporating graph theory into the analysis of network data results in a modest-yet-meaningful improvement in the performance of the tested machine learning models, including logistic regression, support vector machines, and K-means clustering. These results underscore the significance of graph theory representation in bolstering the discriminative capabilities of machine learning algorithms when applied to network data.

show abstract

“…In [ 28 ], a technique was proposed for detecting Botnet cyberattacks using a dynamic sliding window based on residual projection. The technique utilises CD analysis and dynamically updates the sample number by comparing anomalies during the process of finding concepts in data streams.…”

Section: Literature Surveymentioning

confidence: 99%

Enhanced Intrusion Detection with Data Stream Classification and Concept Drift Guided by the Incremental Learning Genetic Programming Combiner

Shyaa

Zainol

Abdullah

et al. 2023

Sensors

View full text Add to dashboard Cite

Concept drift (CD) in data streaming scenarios such as networking intrusion detection systems (IDS) refers to the change in the statistical distribution of the data over time. There are five principal variants related to CD: incremental, gradual, recurrent, sudden, and blip. Genetic programming combiner (GPC) classification is an effective core candidate for data stream classification for IDS. However, its basic structure relies on the usage of traditional static machine learning models that receive onetime training, limiting its ability to handle CD. To address this issue, we propose an extended variant of the GPC using three main components. First, we replace existing classifiers with alternatives: online sequential extreme learning machine (OSELM), feature adaptive OSELM (FA-OSELM), and knowledge preservation OSELM (KP-OSELM). Second, we add two new components to the GPC, specifically, a data balancing and a classifier update. Third, the coordination between the sub-models produces three novel variants of the GPC: GPC-KOS for KA-OSELM; GPC-FOS for FA-OSELM; and GPC-OS for OSELM. This article presents the first data stream-based classification framework that provides novel strategies for handling CD variants. The experimental results demonstrate that both GPC-KOS and GPC-FOS outperform the traditional GPC and other state-of-the-art methods, and the transfer learning and memory features contribute to the effective handling of most types of CD. Moreover, the application of our incremental variants on real-world datasets (KDD Cup ‘99, CICIDS-2017, CSE-CIC-IDS-2018, and ISCX ‘12) demonstrate improved performance (GPC-FOS in connection with CSE-CIC-IDS-2018 and CICIDS-2017; GPC-KOS in connection with ISCX2012 and KDD Cup ‘99), with maximum accuracy rates of 100% and 98% by GPC-KOS and GPC-FOS, respectively. Additionally, our GPC variants do not show superior performance in handling blip drift.

show abstract

Concept Drift Analysis by Dynamic Residual Projection for Effectively Detecting Botnet Cyber-Attacks in IoT Scenarios

Cited by 22 publications

References 37 publications

An Adaptive Scalable Data Pipeline for Multiclass Attack Classification in Large-Scale IoT Networks

An Adaptive Scalable Data Pipeline for Multiclass Attack Classification in Large-Scale IoT Networks

Leveraging Graph-Based Representations to Enhance Machine Learning Performance in IIoT Network Security and Attack Detection

Enhanced Intrusion Detection with Data Stream Classification and Concept Drift Guided by the Incremental Learning Genetic Programming Combiner

Contact Info

Product

Resources

About