Semi-supervised machine learning framework for network intrusion detection

Li, Jieling; Zhang, Hao; Liu, Yanhua; Liu, Zhihuang

doi:10.1007/s11227-022-04390-x

Cited by 10 publications

(5 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To further verify the performance of the proposed method, we compare with Tri-LightGBM [5] and self-learning semi-supervised machine learning [11]. The experimental results are shown in the Figure 3.…”

Section: Comparison With Other Semi-supervised Methodsmentioning

confidence: 99%

“…Therefore, in order to apply it to common scenarios, Zhou et al [4] proposed a new collaborative training algorithm tri-training, which only needs a single view to complete the training of semi-supervised learning, and effectively improves the performance of semi-supervised learning. Li et al [5] proposed a semi-supervised learning framework, using LightGBM as the base classifier of the tri-training algorithm, which effectively improved the performance of NIDS. However, the classifier has the problem of complex parameter tuning and easy overfitting.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A semi-supervised deep learning method in network intrusion detection

Zhang

2023

International Conference on Cyber Security, Artificial Intelligence, and Digital Economy (CSAIDE 2023)

View full text Add to dashboard Cite

Network intrusion detection system (NIDS) plays an important role in network security. With the continuous development of technology, machine learning and deep learning are gradually becoming the main methods of NIDS. However, a large amount of network traffic data has the problem of manual labeling, which results in a limited train datasets, and reduces the performance of NIDS. Semi-supervised learning is a new approach that combines supervised and unsupervised learning to analyze large unlabeled datasets with a small number of labels. In this paper, we propose a semi-supervised deep learning method, which uses improved tri-training algorithm, and combines with deep learning model. We verified the performance of the proposed method on CICIDS2017 datasets. The experimental results show that the proposed method can improve performance of NIDS and outperform other semi-supervised learning methods.

show abstract

Section: Comparison With Other Semi-supervised Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

A semi-supervised deep learning method in network intrusion detection

Zhang

2023

International Conference on Cyber Security, Artificial Intelligence, and Digital Economy (CSAIDE 2023)

View full text Add to dashboard Cite

show abstract

“…Some articles compare PCA with other DRTs such as Autoencoder (AE), t-SNE, Chi-square etc. Jieling 54…”

Section: Analysis Of Articlesmentioning

confidence: 99%

A Comprehensive Review of Dimensionality Reduction Techniques for Real time Network Intrusion Detection with Applications in Cybersecurity

Gondhalekar,

Chattamvelli

2024

Def. Sc. J.

View full text Add to dashboard Cite

This paper reviews popular signature and anomaly-based intrusion detection systems (IDS). Dimensionality reduction techniques (DRT) are used to increase the efficiency of such systems for real-time operation. Autoencoder-based IDS is rapidly gaining in popularity, primarily due to its inherent ability to denoise data and reduce dimensionality. In addition to the efficiency, we also look at the classification techniques used by various authors, and the overall impact of a model in terms of performance metrics. This article is written for novices in cybersecurityto get a jumpstart on the latest IDS algorithms. The purpose is to give useful insights into the broad and progressive view of various techniques in wide use, expose high-impact future research areas and to summarize classic IDS methods and feature selection techniques.

show abstract

“…The framework can improve the accuracy of detection, however, it increases the consumption of training time. A semi-supervised machine learning framework, Tri-LightGBM, based on an integrated approach for network traffic anomaly detection, is proposed in the literature [29]. It improves the performance of anomalous traffic detection by exploiting the information contained in a large amount of unlabeled data and enhances the generalization capability of the framework by a hierarchical sampling approach.…”

Section: Semi-supervised Anomaly Detectionmentioning

confidence: 99%

Semi-supervised attack detection in industrial control systems with deviation networks and feature selection

Liu,

Deng,

Liu

et al. 2024

J Supercomput

Self Cite

View full text Add to dashboard Cite

With the rapid development of Industry 4.0, the importance of cyber security for industrial control systems has become increasingly prominent. The complexity and diversity of industrial control systems result in data with high dimensionality and strong correlation, posing significant challenges in obtaining labeled data. However, current intrusion detection methods often demand large amounts of labeled data for effective training. To address this limitation, this paper proposes a semi-supervised anomaly detection framework, called SFSD, which leverages feature selection and deviation networks to detect anomalies in industrial control systems. Specifically, we introduce a feature selection algorithm (IG-PCA) that utilizes information gain and principal component analysis to reduce the dimensionality of features in industrial control data by eliminating redundant features. Then, we propose a semi-supervised learning method based on an improved deviation network, which utilizes an anomaly scoring network to learn end-to-end anomaly scores for the training data, thus assigning anomaly scores to each training data. Finally, using a limited amount of anomaly-labeled data, we design a specific deviation loss function to optimize the anomaly scoring network, enabling a significant score bias between positive and negative samples. Experimental results demonstrate that the proposed SFSD outperforms existing semi-supervised anomaly detection frameworks by improving the accuracy and detection rate by an average of 1-2%. Moreover, SFSD requires less training time compared to existing frameworks, resulting in a training time reduction of approximately 10% or more.

show abstract

Semi-supervised machine learning framework for network intrusion detection

Cited by 10 publications

References 38 publications

A semi-supervised deep learning method in network intrusion detection

A semi-supervised deep learning method in network intrusion detection

A Comprehensive Review of Dimensionality Reduction Techniques for Real time Network Intrusion Detection with Applications in Cybersecurity

Semi-supervised attack detection in industrial control systems with deviation networks and feature selection

Contact Info

Product

Resources

About