Towards a Standard Feature Set for Network Intrusion Detection System Datasets

Sarhan, Mohanad; Layeghy, Siamak; Portmann, Marius

doi:10.1007/s11036-021-01843-0

Cited by 122 publications

(58 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…of Classes), the proportion of classification or detection accuracy (ACC%), the proportion of positive predictive value (PPV%), and the proportion of true positive rate (TPR%). Also, nine intelligent IoT-IDS-systems are deemed in this assessment as engaging diverse supervised ML systems containing: Extremely Randomized Trees (XRT) Classifier [ 35 ], Statistical Learning (STL) Classifier [ 36 ], eXtreme Gradient Boosting (XGB) Classifier [ 37 , 40 ], Hybrid ML Scheme combining decision trees, random forests, and Naïve bays algorithms (HYB) Classifier [ 38 ], shallow convolutional neural networks (S-CNN) Classifier [ 39 , 60 ], Classification And Regression Trees (CART) Classifier [ 41 ], k-nearest neighbor (kNN) Classifier, and our best system employing ensemble boosted trees (EBT) Classifier. According to the information provided in the table, it can be clearly inferred that our model is prominent as it recorded the best performance results among all other schemes.…”

Section: Resultsmentioning

confidence: 99%

See 1 more Smart Citation

Attack-Aware IoT Network Traffic Routing Leveraging Ensemble Learning

Al‐Haija

Badawi²

2021

Sensors

View full text Add to dashboard Cite

Network Intrusion Detection Systems (NIDSs) are indispensable defensive tools against various cyberattacks. Lightweight, multipurpose, and anomaly-based detection NIDSs employ several methods to build profiles for normal and malicious behaviors. In this paper, we design, implement, and evaluate the performance of machine-learning-based NIDS in IoT networks. Specifically, we study six supervised learning methods that belong to three different classes: (1) ensemble methods, (2) neural network methods, and (3) kernel methods. To evaluate the developed NIDSs, we use the distilled-Kitsune-2018 and NSL-KDD datasets, both consisting of a contemporary real-world IoT network traffic subjected to different network attacks. Standard performance evaluation metrics from the machine-learning literature are used to evaluate the identification accuracy, error rates, and inference speed. Our empirical analysis indicates that ensemble methods provide better accuracy and lower error rates compared with neural network and kernel methods. On the other hand, neural network methods provide the highest inference speed which proves their suitability for high-bandwidth networks. We also provide a comparison with state-of-the-art solutions and show that our best results are better than any prior art by 1~20%.

show abstract

Section: Resultsmentioning

confidence: 99%

“…In a recent work, the authors in [ 35 ] tried to provide a standard feature set for NIDSs. The authors collected two NetFlow-based feature sets and converted four commonly used NIDS datasets (See Table 2 ) to conform with the collected datasets.…”

Section: Related Workmentioning

confidence: 99%

Attack-Aware IoT Network Traffic Routing Leveraging Ensemble Learning

Al‐Haija

Badawi²

2021

Sensors

View full text Add to dashboard Cite

show abstract

“…Table 5 shows a comparison with previous works, including papers [ 16 , 23 , 28 , 29 ]. These papers were selected because they relied on feature importance in performing feature selection.…”

Section: Discussionmentioning

confidence: 99%

“…In 2022, Sarhan et al proposed a standard feature set for network intrusion detection datasets [ 16 ]. The paper focused on general network flow-based intrusion detection including IoT intrusions, as well as other network intrusions.…”

Section: Related Workmentioning

confidence: 99%

Towards an Explainable Universal Feature Set for IoT Intrusion Detection

Alani

Miri

2022

Sensors

View full text Add to dashboard Cite

As IoT devices’ adoption grows rapidly, security plays an important role in our daily lives. As part of the effort to counter these security threats in recent years, many IoT intrusion detection datasets were presented, such as TON_IoT, BoT-IoT, and Aposemat IoT-23. These datasets were used to build many machine learning-based IoT intrusion detection models. In this research, we present an explainable and efficient method for selecting the most effective universal features from IoT intrusion detection datasets that can help in producing highly-accurate and efficient machine learning-based intrusion detection systems. The proposed method was applied to TON_IoT, Aposemat IoT-23, and IoT-ID datasets and resulted in the selection of six universal network-flow features. The proposed method was tested and produced a high accuracy of 99.62% with a prediction time reduced by up to 70%. To provide better insight into the operation of the classifier, a Shapley additive explanation was used to explain the selected features and to prove the alignment of the explanation with current attack techniques.

show abstract

“…2 benchmark NIDS datasets are used in our experiments: NF-UNSW-NB15-v2 and NF-CSE-CIC-IDS2018-v2. These are both updated versions of existing NIDS datasets that have been standardised into a NetFlow format [28] by Sarhan et al [29]. Further details on each dataset are as follows:…”

Section: Datasetsmentioning

confidence: 99%

Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks

Caville¹,

Lo²,

Layeghy³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

This paper investigates Graph Neural Networks (GNNs) application for self-supervised intrusion and anomaly detection in computer networks. GNNs are a deep learning approach for graph-based data that incorporate graph structures into learning to generalise graph representations and output embeddings. As traffic flows in computer networks naturally exhibit a graph structure, GNNs are a suitable fit in this context. The majority of current implementations of GNN-based Network Intrusion Detection Systems (NIDSs) rely heavily on labelled network traffic which can not only restrict the amount and structure of input traffic, but also the NIDS' potential to adapt to unseen attacks. To overcome these restrictions, we present Anomal-E, a GNN approach to intrusion and anomaly detection that leverages edge features and graph topological structure in a self-supervised process. This approach is, to the best our knowledge, the first successful and practical approach to network intrusion detection that utilises network flows in a self-supervised, edge leveraging GNN. Experimental results on two modern benchmark NIDS datasets not only clearly display the improvement of using Anomal-E embeddings, rather than raw features, but also the potential Anomal-E has for detection on wild network traffic.

show abstract

Towards a Standard Feature Set for Network Intrusion Detection System Datasets

Cited by 122 publications

References 14 publications

Attack-Aware IoT Network Traffic Routing Leveraging Ensemble Learning

Attack-Aware IoT Network Traffic Routing Leveraging Ensemble Learning

Towards an Explainable Universal Feature Set for IoT Intrusion Detection

Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks

Contact Info

Product

Resources

About