Intelligent Cyber-Attack Detection and Classification for Network-based Intrusion Detection Systems

Abstract

With the latest advances in information and communication technologies, greater amounts of sensitive user and corporate information are constantly shared across the network making it susceptible to an attack that can compromise data confidentiality, integrity and availability. Intrusion Detection Systems (IDS) are important security mechanisms that can perform a timely detection of malicious events through the inspection of network traffic or host-based logs. Throughout the years, many machine learning techniques have proven to be successful at conducting anomaly detection but only a few considered the sequential nature of data. This work proposes a sequential approach and evaluates the performance of a Random Forest (RF), a Multi-Layer Perceptron (MLP) and a Long-Short Term Memory (LSTM) on the CIDDS-001 dataset. The resulting performance measures of this particular approach are compared with the ones obtained from a more traditional one, that only considers individual flow information, in order to determine which methodology best suits the concerned scenario. The experimental outcomes lead to believe that anomaly detection can be better addressed from a sequential perspective and that the LSTM is a very reliable model for acquiring sequential patterns in network traffic data, achieving an accuracy of 99.94% and a f1-score of 91.66%.

Multivariable Heuristic Approach to Intrusion Detection in Network Environments

“…The key purpose of IDS is to detect unwanted traffic in the network that could be a potential attack [ 50 ]. There are two main types of detection techniques [ 51 ]: misuse detection and anomaly detection.…”

A Tool to Support the Investigation and Visualization of Cyber and/or Physical Incidents

“…Several algorithms such as Random Forest, Multi-layer Perceptron and Long Short-Term Memory were experimented. For a more detailed description of the employed methods readers can be redirected to [22].…”

A Novel Open Set Energy-based Flow Classifier for Network Intrusion Detection

“…Different from binary classifiers, recent reviews of the literature [15], [19], [20], [21] identify common multi-class classifiers employed in NIDS using KNN [22], SVM [22], NB [22] [23] [24], DT [24], RF [23] [24] [25], and Artificial Neural Network (ANN) [25] [26] [27]. Although these classifiers are capable of achieving high accuracy labeling known intrusions from training with attack databases, they lack the capability of detecting unknown attacks.…”