Feature selection, learning metrics and dimension reduction in training and classification processes in intrusion detection systems
Date
2015-12-20
2015-12-20
Metadata
Show full item record
Show full item record
Abstract
This research presents an IDS prototype in Matlab that assess network traffic connections contained in the NSL-KDD dataset, comparing feature selection techniques available in FEAST toolbox, refining prior results applying dimension reduction technique ISOMAP. The classification process used a supervised learning technique called Support Vector Machines (SVM). The comparative analysis related to detection rates by attack category are conclusive that MRMR+PCA+SVM (selection, reduction and classification techniques) combined obtained more promising results, just using 5 of 41 available features in the dataset. The results obtained were: 85.42% normal traffic, 80.77% DoS, 90.41% Probe, 91.78% U2R and 83.25% R2L.
Referencias:
[1] Garcia, P., Diaz, J., Macia, G. and Vasquez, E., “Anomaly-based network intrusion detection: Techniques, systems and challenges”, in journal Computers & Security, Vol. 28, pp. 18-28, 2009. [2] Xiaonan, S. and Banzhaf, W., “The use of computational intelligence in intrusion detection systems: A review”, in journal Applied Soft Computing, Vol. 10, pp. 1-35, 2010. [3] Symantec. 2015 Internet Security Threat Report [online]. Available: http://www.symantec.com/security_response/pu blications/threatreport.jsp [4] Cisco Systems. Cisco survey evolving security threats [online]. Available: http://www.enterprisetech.com/2015/04/07/cisc o-survey-sees-evolving-security-threats/ [5] Catania, C., Garcia, C., “Reconocimiento de Patrones en el Trafico de Red Basado en Algoritmos Genéticos”, Revista Iberoamericana de Inteligencia Artificial, Vol 12, pp. 65-75, 2008. [6] De la hoz, E., Ortiz, A., Ortega, J., De la hoz, E. And Mendoza, F., “Implementation of an Intrusion Detection System Based on Self Organizing Map”, in Journal of Theoretical and Applied Information Technology, Vol. 71, pp. 324-334, 2015. [7] Mendoza, F., De la hoz, E. And De la hoz, A., “Application of Feast (Feature Selection Toolbox) in IDS (Intrusion Detection Systems)”, in Journal of Theoretical and Applied Information Technology, Vol. 70, pp. 579-585, 2014. [8] Lorenzo, I., Macia, F., Mora, F., Gil, J., and Marcos, J., “Modelo Eficiente y Escalable para la Deteccion de Intrusos en Red”, in XXIV Simposium Nacional de la Unión Científica Internacional de Radio (URSI'09), 2009. [9] Xiaoqing, G., Hebin, G., and Luyi, C., “Network Intrusion Detection Method Based on Agent and SVM”, in Information Management and Engineering (ICIME), 2010 The 2nd IEEE International Conference on, pp. 399 – 402, 2010. [10] Kuang, L., and Zulkernine, M., “An Anomaly Intrusion Detection Method Using the CSIKNN Algorithm”, in Proceedings of the 2008 ACM Symposium on Applied Computing, pp. 921- 926, 2008. [11] W. Hu, Y. Liao, and V. Vemuri. “Robust Support Vector Machines for Anomaly Detection in Computer Security”. In ICMLA, pp. 168–174, 2003. [12] Tajbakhsh, A., Rahmati, M., and Mirzaei, A., “Intrusion detection using fuzzy association rules”. In Applied Soft Computing, Vol. 9(2), pp. 462-469, 2009. [13] Wang, G., Hao, J., Ma, J., and Huang, L., “A new approach to intrusion detection usingArtificial Neural Networks and fuzzy clustering”. In Expert Systems with Applications, Vol. 37(9), pp. 6225-6232, 2010. [14] Microsoft. Selección de Características (Minería de Datos) [online]. Available: https://msdn.microsoft.com/eses/library/ms175382(v=sql.120).aspx [15] Oporto, S., Aquino, I., Chavez, J., Perez, C., Comparación de Cuatro Técnicas de Selección de Características Envolventes usando Neuronales, Arboles de Decisión, Maquinas de Vector de Soporte y Clasificador Bayesiano. [16] Goldberg, D. And Holland, J., “Genetic algorithms and machine learning”, in Machine learning, Vol. 3(2), pp. 95-99, 1998. [17] Liu, H., & Motoda, H, “Feature selection for knowledge discovery and data mining”, in Springer Science & Business Media, Vol. 454, 2012. [18] University of Manchester. A Feature Selection Toolbox for C and Matlab [online]. Available: http://www.cs.man.ac.uk/~gbrown/fstoolbox/. [19] Van Der Maaten, L., Matlab Toolbox for Dimensionality Reduction [online]. Available : http://lvdmaaten.github.io/drtoolbox/ [20] Lohweg, V., and Mönks, U., “Fuzzy-PatternClassifier Based Sensor Fusion for Machine Conditioning”. INTECH Open Access Publisher, 2010. [21] De la Hoz, E., De La Hoz, E., Ortiz, A., Ortega, J., and Prieto, B., “PCA filtering and probabilistic SOM for network intrusion detection”, in Neurocomputing, vol. 164, pp. 71-81 2015. [22] Turk, M. and Pentland, A., “Eigenfaces for Recognition”, in journal of cognitive neuroscience, Vol. 3, pp. 71-86, 2007. [23] Schölkopf, B., Smola, A., and Müller, K., “Nonlinear component analysis as a kernel eigenvalue problema”, in Neural computation, Vol. 10(5), pp. 1299-1319, 1998. [24] Mika, S., Schölkopf, B., Smola, A. J., Müller, K. R., Scholz, M., and Rätsch, G., “Kernel PCA and De-Noising in Feature Spaces”. In NIPS, Vol. 4, No. 5, pp. 7, 1998. [25] Rosipal, R., Girolami, M., and Trejo, L., “Kernel PCA for feature extraction and denoising in nonlinear regression”. Technical Report No. 4, Department of Computing and Information Systems, University of Paisley, 2000. [26] Xiao, X., and Tao, C., “ISOMAP AlgorithmBased Feature Extraction for Electromechanical Equipment Fault Prediction”, in Image and Signal Processing, 2009. CISP '09. 2nd International Congress on, pp. 1-4, 2009. [27] Burges, C., Schölkopf, B. And Smola, A., “Advances in kernel methods: Support vector machines”. Cambridge, MA: MIT Press, 1999. [28] Burges, C., “A tutorial on support vector machines for pattern recognition”. Data Mining and Knowledge Discovery, vol. 2, no. 2, 1998. [29] Vapnik, V., “The nature of statistical learning theory”. New York: Springer-Verlag, 1995. [30] Betancourt, G., Las Maquinas de Soporte Vectorial (SVMs), Universidad Tecnológica de Pereira, 2005. [31] University of California. The UCI KDD Archive [online]. Available: http://kdd.ics.uci.edu/databases/kddcup99/kddc up99.html. [32] MIT Lincoln Laboratory. 1998 DARPA Intrusion Detection Evaluation Data Set. [online]. Available: http://www.ll.mit.edu/ideval/data/1998data.html [33] Stolfo, S., Fan, W., Lee, W., Prodromidis, A., and Chan, P., “Costbased modeling for fraud and intrusion detection: Results from the jam project,” discex, vol. 02, pp. 1130, 2000. [34] Tribak, H., “Análisis Estadístico de Distintas Técnicas de Inteligencia Artificial en Detección de Intrusos”. Tesis Doctoral, 2012. [35] Sabnani, S., Computer Security: A machine learning Approach, Technical Report, University of London, 2008.
[1] Garcia, P., Diaz, J., Macia, G. and Vasquez, E., “Anomaly-based network intrusion detection: Techniques, systems and challenges”, in journal Computers & Security, Vol. 28, pp. 18-28, 2009. [2] Xiaonan, S. and Banzhaf, W., “The use of computational intelligence in intrusion detection systems: A review”, in journal Applied Soft Computing, Vol. 10, pp. 1-35, 2010. [3] Symantec. 2015 Internet Security Threat Report [online]. Available: http://www.symantec.com/security_response/pu blications/threatreport.jsp [4] Cisco Systems. Cisco survey evolving security threats [online]. Available: http://www.enterprisetech.com/2015/04/07/cisc o-survey-sees-evolving-security-threats/ [5] Catania, C., Garcia, C., “Reconocimiento de Patrones en el Trafico de Red Basado en Algoritmos Genéticos”, Revista Iberoamericana de Inteligencia Artificial, Vol 12, pp. 65-75, 2008. [6] De la hoz, E., Ortiz, A., Ortega, J., De la hoz, E. And Mendoza, F., “Implementation of an Intrusion Detection System Based on Self Organizing Map”, in Journal of Theoretical and Applied Information Technology, Vol. 71, pp. 324-334, 2015. [7] Mendoza, F., De la hoz, E. And De la hoz, A., “Application of Feast (Feature Selection Toolbox) in IDS (Intrusion Detection Systems)”, in Journal of Theoretical and Applied Information Technology, Vol. 70, pp. 579-585, 2014. [8] Lorenzo, I., Macia, F., Mora, F., Gil, J., and Marcos, J., “Modelo Eficiente y Escalable para la Deteccion de Intrusos en Red”, in XXIV Simposium Nacional de la Unión Científica Internacional de Radio (URSI'09), 2009. [9] Xiaoqing, G., Hebin, G., and Luyi, C., “Network Intrusion Detection Method Based on Agent and SVM”, in Information Management and Engineering (ICIME), 2010 The 2nd IEEE International Conference on, pp. 399 – 402, 2010. [10] Kuang, L., and Zulkernine, M., “An Anomaly Intrusion Detection Method Using the CSIKNN Algorithm”, in Proceedings of the 2008 ACM Symposium on Applied Computing, pp. 921- 926, 2008. [11] W. Hu, Y. Liao, and V. Vemuri. “Robust Support Vector Machines for Anomaly Detection in Computer Security”. In ICMLA, pp. 168–174, 2003. [12] Tajbakhsh, A., Rahmati, M., and Mirzaei, A., “Intrusion detection using fuzzy association rules”. In Applied Soft Computing, Vol. 9(2), pp. 462-469, 2009. [13] Wang, G., Hao, J., Ma, J., and Huang, L., “A new approach to intrusion detection usingArtificial Neural Networks and fuzzy clustering”. In Expert Systems with Applications, Vol. 37(9), pp. 6225-6232, 2010. [14] Microsoft. Selección de Características (Minería de Datos) [online]. Available: https://msdn.microsoft.com/eses/library/ms175382(v=sql.120).aspx [15] Oporto, S., Aquino, I., Chavez, J., Perez, C., Comparación de Cuatro Técnicas de Selección de Características Envolventes usando Neuronales, Arboles de Decisión, Maquinas de Vector de Soporte y Clasificador Bayesiano. [16] Goldberg, D. And Holland, J., “Genetic algorithms and machine learning”, in Machine learning, Vol. 3(2), pp. 95-99, 1998. [17] Liu, H., & Motoda, H, “Feature selection for knowledge discovery and data mining”, in Springer Science & Business Media, Vol. 454, 2012. [18] University of Manchester. A Feature Selection Toolbox for C and Matlab [online]. Available: http://www.cs.man.ac.uk/~gbrown/fstoolbox/. [19] Van Der Maaten, L., Matlab Toolbox for Dimensionality Reduction [online]. Available : http://lvdmaaten.github.io/drtoolbox/ [20] Lohweg, V., and Mönks, U., “Fuzzy-PatternClassifier Based Sensor Fusion for Machine Conditioning”. INTECH Open Access Publisher, 2010. [21] De la Hoz, E., De La Hoz, E., Ortiz, A., Ortega, J., and Prieto, B., “PCA filtering and probabilistic SOM for network intrusion detection”, in Neurocomputing, vol. 164, pp. 71-81 2015. [22] Turk, M. and Pentland, A., “Eigenfaces for Recognition”, in journal of cognitive neuroscience, Vol. 3, pp. 71-86, 2007. [23] Schölkopf, B., Smola, A., and Müller, K., “Nonlinear component analysis as a kernel eigenvalue problema”, in Neural computation, Vol. 10(5), pp. 1299-1319, 1998. [24] Mika, S., Schölkopf, B., Smola, A. J., Müller, K. R., Scholz, M., and Rätsch, G., “Kernel PCA and De-Noising in Feature Spaces”. In NIPS, Vol. 4, No. 5, pp. 7, 1998. [25] Rosipal, R., Girolami, M., and Trejo, L., “Kernel PCA for feature extraction and denoising in nonlinear regression”. Technical Report No. 4, Department of Computing and Information Systems, University of Paisley, 2000. [26] Xiao, X., and Tao, C., “ISOMAP AlgorithmBased Feature Extraction for Electromechanical Equipment Fault Prediction”, in Image and Signal Processing, 2009. CISP '09. 2nd International Congress on, pp. 1-4, 2009. [27] Burges, C., Schölkopf, B. And Smola, A., “Advances in kernel methods: Support vector machines”. Cambridge, MA: MIT Press, 1999. [28] Burges, C., “A tutorial on support vector machines for pattern recognition”. Data Mining and Knowledge Discovery, vol. 2, no. 2, 1998. [29] Vapnik, V., “The nature of statistical learning theory”. New York: Springer-Verlag, 1995. [30] Betancourt, G., Las Maquinas de Soporte Vectorial (SVMs), Universidad Tecnológica de Pereira, 2005. [31] University of California. The UCI KDD Archive [online]. Available: http://kdd.ics.uci.edu/databases/kddcup99/kddc up99.html. [32] MIT Lincoln Laboratory. 1998 DARPA Intrusion Detection Evaluation Data Set. [online]. Available: http://www.ll.mit.edu/ideval/data/1998data.html [33] Stolfo, S., Fan, W., Lee, W., Prodromidis, A., and Chan, P., “Costbased modeling for fraud and intrusion detection: Results from the jam project,” discex, vol. 02, pp. 1130, 2000. [34] Tribak, H., “Análisis Estadístico de Distintas Técnicas de Inteligencia Artificial en Detección de Intrusos”. Tesis Doctoral, 2012. [35] Sabnani, S., Computer Security: A machine learning Approach, Technical Report, University of London, 2008.
Collections