Trends in Application of Machine Learning to Network-Based Intrusion Detection Systems

Hrabovsky, Jakub; Segeč, Pavel; Moravčík, Marek; Papán, Jozef

doi:10.1007/978-3-319-93408-2_16

Cited by 3 publications

(3 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Out team is working on this research in the field of advanced monitoring of flows and in the evaluation of security events for networks and cloud computing systems. Several articles were published by our team on the topic of CC systems [38], their security architecture [39], the management of cybersecurity incidents and on creating a packet capture infrastructure for creating valuable datasets [40].…”

Section: Motivationmentioning

confidence: 99%

One-Parameter Statistical Methods to Recognize DDoS Attacks

et al. 2022

View full text Add to dashboard Cite

Within our academic high-speed network infrastructure which is used for connecting all universities and high schools in our country to the Internet, there are thousands of cybersecurity attacks occurring every day. That is why, within our SANET II project, an effort has been made to create a self-learning system without a teacher, which would be able to quickly adapt to arbitrary traffic and recognize DDoS attacks on time, even in high-speed networks, with a potential simple implementation into a hardware probe. In the article, we deal with the Hurst and autoregression coefficients and the coefficient of variation. We test the coefficients on simulated data and on real records of attacks. For early machine recognition of the attack, we propose the so-called predicting σ-tunnel. The obtained results can lead to the investigation of other prediction methods that would improve the early recognition of an attack.

show abstract

Section: Motivationmentioning

confidence: 99%

One-Parameter Statistical Methods to Recognize DDoS Attacks

et al. 2022

View full text Add to dashboard Cite

show abstract

“…A stacking ensemble methodology was suggested in the study [14][15][16]. The ensemble technique involves LR, KNN, RF and SVM.…”

Section: Related Workmentioning

confidence: 99%

Vigorous IDS on Nefarious Operations and Threat Analysis Using Ensemble Machine Learning

Musa¹,

Chakraborty²,

Sharma³

et al. 2021

RIA

View full text Add to dashboard Cite

The geometric increase in the usage of computer networking activities poses problems with the management of network normal operations. These issues had drawn the attention of network security researchers to introduce different kinds of intrusion detection systems (IDS) which monitor data flow in a network for unwanted and illicit operations. The violation of security policies with nefarious motive is what is known as intrusion. The IDS therefore examine traffic passing through networked systems checking for nefarious operations and threats, which then sends warnings if any of these malicious activities are detected. There are 2 types of detection of malicious activities, misuse detection, in this case the information about the passing network traffic is gathered, analyzed, which is then compared with the stored predefined signatures. The other type of detection is the Anomaly detection which is detecting all network activities that deviates from regular user operations. Several researchers have done various works on IDS in which they employed different machine learning (ML), evaluating their work on various datasets. In this paper, an efficient IDS is built using Ensemble machine learning algorithms which is evaluated on CIC-IDS2017, an updated dataset that contains most recent attacks. The results obtained show a great increase in the rate of detection, increase in accuracy as well as reduction in the false positive rates (FPR).

show abstract

“…Our team is actively engaged in advanced flow monitoring and assessing security events for both networks and Cloud Computing systems. Numerous articles authored by our team delve into CC systems [4], their security architecture [5], the management of cybersecurity incidents, and the establishment of a packet capture infrastructure to generate valuable datasets [6,7].…”

mentioning

confidence: 99%

Machine Recognition of DDoS Attacks Using Statistical Parameters

Smiesko,

Segec,

Kontsek

2023

Mathematics

Self Cite

View full text Add to dashboard Cite

As part of the research in the recently ended project SANET II, we were trying to create a new machine-learning system without a teacher. This system was designed to recognize DDoS attacks in real time, based on adaptation to real-time arbitrary traffic and with the ability to be embedded into the hardware implementation of network probes. The reason for considering this goal was our hands-on experience with the high-speed SANET network, which interconnects Slovak universities and high schools and also provides a connection to the Internet. Similar to any other public-facing infrastructure, it is often the target of DDoS attacks. In this article, we are extending our previous research, mainly by dealing with the use of various statistical parameters for DDoS attack detection. We tested the coefficients of Variation, Kurtosis, Skewness, Autoregression, Correlation, Hurst exponent, and Kullback–Leibler Divergence estimates on traffic captures of different types of DDoS attacks. For early machine recognition of the attack, we have proposed several detection functions that use the response of the investigated statistical parameters to the start of a DDoS attack. The proposed detection methods are easily implementable for monitoring actual IP traffic.

show abstract

Trends in Application of Machine Learning to Network-Based Intrusion Detection Systems

Cited by 3 publications

References 36 publications

One-Parameter Statistical Methods to Recognize DDoS Attacks

One-Parameter Statistical Methods to Recognize DDoS Attacks

Vigorous IDS on Nefarious Operations and Threat Analysis Using Ensemble Machine Learning

Machine Recognition of DDoS Attacks Using Statistical Parameters

Contact Info

Product

Resources

About