Re-evaluation of combined Markov-Bayes models for host intrusion detection on the ADFA dataset

Intrusion Detection System Based on Integrated System Calls Graph and Neural Networks

“…There are works that introduce the idea of combining two techniques to achieve better performance [48]. The work discusses the combination of the probabilistic models Markov and Bayes for host-based intrusion detection.…”

“…On the one hand, the main difference between our proposal and those presented in this section is that our proposal employs multiple techniques and these works use only one technique. On the other hand, several papers show systems that use two methods [48]- [52], but our proposal combines more methods and represents all the information in a single data structure.…”

Prepare for trouble and make it double! Supervised – Unsupervised stacking for anomaly-based intrusion detection

“… Priority to papers published in international journals rather than conferences, whenever possible. Our review ended up selecting 15 papers: 2 for ADFANet [87], [88], 3 for CICIDS17 [80], [82], [83], 3 for CIDDS-001 [82], [84], [89], 2 for ISCX12 [79], [81], 3 for NSL-KDD [78], [81], [83], 3 for UGR16 [76], [85], [86], and 4 for UNSW-NB15 [76], [77], [81], [83]. Those papers use metrics different than MCC to evaluate intrusion detectors; consequently, we calculated common metrics achieved by the Stacker on each dataset to enable comparisons.…”

Network Based Intrusion Detection Using the UNSW-NB15 Dataset

“…Minimizing the Log Loss is basically equivalent to maximizing the accuracy of the classifier. For this, we define Log Loss as: (6) where N is the number of samples or instances, M is the number of possible labels, y ij is a binary indicator of whether or not label j is the correct classification for instance i, and p ij is the model probability of assigning label j to instance i. As depicted in Figure 6, we determined a number of 2000 trees with a shrinkage value of 0.01 in order to achieve a good log loss of 0.1567176.…”

“…To counter both internal and external intrusions, Intrusion Detection System (IDS) are deployed by network administrators to protect key network and enterprise services from both internal and external intrusion attempts. http://dx.doi.org/10.12785/ijcds/080505 https://journal.uob.edu.bh Two classes of IDSs have emerged, namely (i) those that operate on network traffic called Network Intrusion Detection Systems (NIDS) [4]; they are often collocated with Firewalls and use network traffic traces for detecting intrusions, and (ii) Host Intrusion Detection Systems (HIDS) [5,6]; this breed is deployed on each network host, and uses information other than network traffic to detect intrusions. Such information includes application activity, traces, system calls and their parameters.…”