Machine Learning Techniques for Intrusion Detection

Ahmad, Tameem; Anwar, Mohd; Haque, Mohammad Israrul

doi:10.4018/978-1-7998-2242-4.ch003

Cited by 8 publications

(2 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…20 Increased detection rates, decreased false alarm rates, and less expenses are all advantages of using ML techniques. 21 As illustrated…”

Section: Machine Learning Techniquesmentioning

confidence: 99%

Detection of attacks on software defined networks using machine learning techniques and imbalanced data handling methods

Hassan,

Hemdan,

El‐Shafai

et al. 2023

Security and Privacy

View full text Add to dashboard Cite

Software‐defined networks (SDNs) have gained popularity in recent years as a solution for the fundamental issues that affect traditional dispersed networks. The primary advantage of SDNs is the decoupling of the control plane from the data plane, which increases the flexibility of the network. The SDN represents a network architecture of the next generation, however, its configuration options are centralized, leaving it open for cyber‐attacks. This paper concentrates on the early identification of attacks in an SDN environment. When malicious traffic is affecting in an SDN topology, an artificial intelligence (AI) module in the topology is used to detect the attack and stop the attack source using machine learning (ML) techniques. The architecture presented in this research allows for the comparison of several ML classification techniques that are used to identify different sorts of network attacks. For attack detection, eight ML techniques are used, namely logistic regression (LR), linear discriminant analysis (LDA), Naïve Bayes (NB), k‐nearest neighbor (KNN), classification and regression tree (CART), AdaBoost (AB), random forest (RF), and support‐vector machine (SVM) classifiers. These techniques are tested on the InSDN dataset, which is a novel attack‐specific SDN dataset. The results show that the highest accuracy of 98.6% is achieved with the LDA classifier. Further improvement in the accuracy of classification models is observed when random over‐sampling, synthetic minority oversampling technique (SMOTE), random under‐sampling, and under‐sampling with Tomek links and near‐miss concept are applied to address the class imbalance problem. After applying these methods, the LDA classifier showed an accuracy of 98.79%.

show abstract

“…20 Increased detection rates, decreased false alarm rates, and less expenses are all advantages of using ML techniques. 21 As illustrated…”

Section: Machine Learning Techniquesmentioning

confidence: 99%

Detection of attacks on software defined networks using machine learning techniques and imbalanced data handling methods

Hassan,

Hemdan,

El‐Shafai

et al. 2023

Security and Privacy

View full text Add to dashboard Cite

show abstract

“…As cyberattacks are constantly evolving, so IDS must also progress to be efficient [9]. A set of research works are focused on improving the operation and performance of the IDS.…”

Section: Related Workmentioning

confidence: 99%

A Vote-Based Architecture to Generate Classified Datasets and Improve Performance of Intrusion Detection Systems Based on Supervised Learning

Malta

Pinto

2022

Future Internet

View full text Add to dashboard Cite

An intrusion detection system (IDS) is an important tool to prevent potential threats to systems and data. Anomaly-based IDSs may deploy machine learning algorithms to classify events either as normal or anomalous and trigger the adequate response. When using supervised learning, these algorithms require classified, rich, and recent datasets. Thus, to foster the performance of these machine learning models, datasets can be generated from different sources in a collaborative approach, and trained with multiple algorithms. This paper proposes a vote-based architecture to generate classified datasets and improve the performance of supervised learning-based IDSs. On a regular basis, multiple IDSs in different locations send their logs to a central system that combines and classifies them using different machine learning models and a majority vote system. Then, it generates a new and classified dataset, which is trained to obtain the best updated model to be integrated into the IDS of the companies involved. The proposed architecture trains multiple times with several algorithms. To shorten the overall runtimes, the proposed architecture was deployed in Fed4FIRE+ with Ray to distribute the tasks by the available resources. A set of machine learning algorithms and the proposed architecture were assessed. When compared with a baseline scenario, the proposed architecture enabled to increase the accuracy by 11.5% and the precision by 11.2%.

show abstract