LNNLS-KH: A Feature Selection Method for Network Intrusion Detection

Xin, Li; Peng, Yi; Wei, Wei; Jiang, Yiming; Tian, Le

doi:10.1155/2021/8830431

Cited by 31 publications

(19 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Unlike feature extraction, feature selection preserves the physical meaning of the original features by retaining some of the data, and thus makes the model more readable and interpretable [ 9 , 10 ]. In the field of intrusion detection, where datasets are characterized by a large volume of data and high dimensionality, feature selection reduces computational difficulty and eliminates data redundancy [ 11 ], thereby improving the detection rate of the model and reducing false positives. For example, a firefly algorithm was used for feature selection and to pass the generated features through a classifier based on C4.5 and a Bayesian network (BN) to complete the classification for intrusion detection [ 12 ].…”

Section: Background and Related Workmentioning

confidence: 99%

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

Song

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

Imbalanced datasets greatly affect the analysis capability of intrusion detection models, biasing their classification results toward normal behavior and leading to high false-positive and false-negative rates. To alleviate the impact of class imbalance on the detection accuracy of network intrusion detection models and improve their effectiveness, this paper proposes a method based on a feature selection-conditional Wasserstein generative adversarial network (FCWGAN) and bidirectional long short-term memory network (BiLSTM). The method uses the XGBoost algorithm with Spearman’s correlation coefficient to select the data features, filters out useless and redundant features, and simplifies the data structure. A conditional WGAN (CWGAN) is used to generate a small number of samples in the dataset, add them to the original training set to supplement the dataset samples, and apply BiLSTM to complete the training of the model and realize the classification. In comparative tests based on the NSL-KDD and UNSW-NB15 datasets, the accuracy of the proposed model reached 99.57% and 85.59%, respectively, which is 1.44% and 2.98% higher than that of the same type of CWGAN and deep neural network (CWGAN-DNN) model, respectively.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

Song

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

show abstract

“…Another study [53] proposed linear nearest neighbor lasso step (LNNLS-KH) to select features of intrusion detection. They implemented LNNLS-KH on renewed krill herd position to obtain the optimal global solution.…”

Section: Related Workmentioning

confidence: 99%

Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things

et al. 2021

View full text Add to dashboard Cite

The need for timely identification of Distributed Denial-of-Service (DDoS) attacks in the Internet of Things (IoT) has become critical in minimizing security risks as the number of IoT devices deployed rapidly grows globally and the volume of such attacks rises to unprecedented levels. Instant detection facilitates network security by speeding up warning and disconnection from the network of infected IoT devices, thereby preventing the botnet from propagating and thereby stopping additional attacks. Several methods have been developed for detecting botnet attacks, such as Swarm Intelligence (SI) and Evolutionary Computing (EC)-based algorithms. In this study, we propose a Local-Global best Bat Algorithm for Neural Networks (LGBA-NN) to select both feature subsets and hyperparameters for efficient detection of botnet attacks, inferred from 9 commercial IoT devices infected by two botnets: Gafgyt and Mirai. The proposed Bat Algorithm (BA) adopted the local-global best-based inertia weight to update the bat’s velocity in the swarm. To tackle with swarm diversity of BA, we proposed Gaussian distribution used in the population initialization. Furthermore, the local search mechanism was followed by the Gaussian density function and local-global best function to achieve better exploration during each generation. Enhanced BA was further employed for neural network hyperparameter tuning and weight optimization to classify ten different botnet attacks with an additional one benign target class. The proposed LGBA-NN algorithm was tested on an N-BaIoT data set with extensive real traffic data with benign and malicious target classes. The performance of LGBA-NN was compared with several recent advanced approaches such as weight optimization using Particle Swarm Optimization (PSO-NN) and BA-NN. The experimental results revealed the superiority of LGBA-NN with 90% accuracy over other variants, i.e., BA-NN (85.5% accuracy) and PSO-NN (85.2% accuracy) in multi-class botnet attack detection.

show abstract

“…When the system is compared with various existing systems, such as SVM and decision tree algorithm, it is noted that the system has the ability to detect botnet attacks with successful results. HaddadPajouh et al [23] A study [31] used traditional machine learning, such as linear nearest neighbor lasso step (LNNLS-KH), to extract significant features for enhancing a system. e LNNLS-KH method is used to renew krill herd position to obtain the optimal global solution.…”

Section: Related Workmentioning

confidence: 99%

Botnet Attack Detection by Using CNN-LSTM Model for Internet of Things Applications

Alkahtani

Aldhyani

2021

Security and Communication Networks

View full text Add to dashboard Cite

The Internet of Things (IoT) has grown rapidly, and nowadays, it is exploited by cyber attacks on IoT devices. An accurate system to identify malicious attacks on the IoT environment has become very important for minimizing security risks on IoT devices. Botnet attacks are among the most serious and widespread attacks, and they threaten IoT devices. Motionless IoT devices have a security weakness due to lack of sufficient memory and computation results for a security platform. In addition, numerous existing systems present themselves for finding unknown patterns from IoT networks to improve security. In this study, hybrid deep learning, a convolutional neural network and long short-term memory (CNN-LSTM) algorithm, was proposed to detect botnet attacks, namely, BASHLITE and Mirai, on nine commercial IoT devices. Extensive empirical research was performed by employing a real N-BaIoT dataset extracted from a real system, including benign and malicious patterns. The experimental results exposed the superiority of the CNN-LSTM model with accuracies of 90.88% and 88.61% in detecting botnet attacks from doorbells (Danminin and Ennio brands), whereas the proposed system achieved good accuracy (88.53%) in identifying botnet attacks from thermostat devices. The accuracies of the proposed system in detecting botnet attacks from security cameras were 87.19%, 89.23%, 87.76%, and 89.64%, with respect to accuracy metrics. Overall, the CNN-LSTM model was successful in detecting botnet attacks from various IoT devices with optimal accuracy.

show abstract

LNNLS-KH: A Feature Selection Method for Network Intrusion Detection

Cited by 31 publications

References 44 publications

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things

Botnet Attack Detection by Using CNN-LSTM Model for Internet of Things Applications

Contact Info

Product

Resources

About