شناسایی جریان‌های مخرب در شبکه با به‌کارگیری اجماع

نوع مقاله : مقاله پژوهشی

نویسندگان

1 استادیار دانشگاه آزاد اسلامی یاسوج

2 دانشگاه آزاد اسلامی یاسوج

3 دانشگاه ازاد اسلامی یاسوج

4 باشگاه پژوهشگران جوان و نخبگان دانشگاه ازاد اسلامی یاسوج

5 دانشگاه آزاد اسلامی واحد شیراز

چکیده

مقوله امنیت در شرایط جدید جهانی ابعاد متفاوتی پیدا کرده است. یکی از حوزه‌های امنیتی که در شرایط جدید جهانی بسیار مورد اهمیت قرار گرفته است، حوزه امنیت سایبری است. در این تحقیق برای مطالعه بر روی حملات ناشناخته دو هانی‌نت آزمایشگاهی مجازی در دو مکان مختلف طراحی شده و همچنین از سایر مجموعه داده‌های علمی استفاده گردیده است. در داده‌های شبکه‌ای، مشکل داده‌های نامتوازن اغلب اتفاق می‌افتد و موجب کاهش کارایی در پیش‌بینی برای رده‌‌هایی که در اقلیت هستند، می‌گردد. در این مقاله برای حل این مشکل، از روش‌های یادگیری جمعی استفاده گردیده است تا بتوان مدلی خودکار ارائه نمود که با استفاده از فنون مختلف و با استفاده از یادگیری مدل، حملات شبکه به‌ویژه حملات ناشناخته را شناسایی نماید. روش‌های جمعی، بسیار مناسب برای توصیف مشکلات امنیتی رایانه‌ای می‌باشند زیرا هر فعالیتی که در سیستم‌های رایانه‌ای انجام می‌گیرد را می‌توان در سطوح چند انتزاعی مشاهده کرد و اطلاعات مرتبط را می‌توان از منابع اطلاعاتی چندگانه جمع‌آوری نمود. روش تحقیق بر اساس تحلیل‌های آماری جهت برسی میزان صحت و درستی نتایج و میزان اتکاپذیری آن‌ها صورت گرفته است. در این مرحله به‌کمک فنون و آزمایش‌‌های آماری نشان داده شده که عملکرد الگوریتم طراحی شده با رأی‌گیری وزنی پیشنهادی بر اساس الگوریتم ژنتیک نسبت به دوازده طبقه‌بند دیگر بهتر می‌باشد.

کلیدواژه‌ها


عنوان مقاله [English]

Detection of Unknown Malicious Network Streams using Ensemble Learning

نویسندگان [English]

  • Hamid Parvin 1
  • Vahideh Rezaei 2
  • Samad Nejatian 3
  • Roohullah Omidvar 4
  • Milad Yasrebi 5
1 -
2
3
4
5
چکیده [English]

Security is a significant issue in this world and is given several dimensions by varying circumstances.
Among different security areas, cyber security can be claimed to have one of the most important places in
new circumstances of this world. In this study, two virtual honeynets were designed in two different laboratories
to help us study unknown attacks. Other scientific datasets were also used for this purpose. Imbalanced
data always cause problems for network datasets and reduce the efficiency for the prediction of minority
classes. To cope with this problem, ensemble learning methods were applied in order to detect network
attacks and most specifically, unknown attacks, while taking advantage of different techniques and
action model learning. It was found that ensemble learning method was suitable for describing the security
problems because activities done on computer systems can be viewed at multiple levels of abstraction and
information can be collected from multiple data sources. Statistical analysis was used as the research
method in order to measure the reliability and validity of findings. Here, we applied statistical techniques
and tests to show that the algorithm designed by the proposed weighted voting and based on the genetic
algorithm has a better performance than other twelve classifiers.

کلیدواژه‌ها [English]

  • Honeynet
  • Unknown Attacks
  • Ensemble Learning
  • Imbalanced Data
  • Weighted Voting
  • Statistical Tests
   [1]      R. Talabis, “Honeynet learning: discovering IT security,” SIGCSE Bull, vol. 38, pp. 110-114, 2006.##
   [2]      S. Hido and H. Kashima, “Roughly balanced bagging for imbalanced data,” Statistical Analysis and Data Mining: the ASA Data Science, vol. 5, pp. 143-152, 2009.##
   [3]      P. Kang and S. Cho, “Ensemble of under-sampled SVMs for data imbalance problems,” Lecture Notes in Computer Science, vol. 4232, pp. 837–846, 2006.##
   [4]      I. Corona, G. Giacinto, C. Mazzariello, F. Roli, and C. Sansone, “Information fusion for computer security: state of the art and open issues,” Information Fusion, vol. 10, no. 4, pp. 274–284, 2009.##
   [5]      J. Z. Kolter and M. A. Maloof, “Learning to detect and classify malicious executables in the wild,” Journal of Machine Learning Research, vol. 7, pp. 2721–2744, 2006.##
   [6]      M. G. Schultz, E. Eskin, E. Zadok, and S. J. Stolfo, “Data mining methods for detection of new malicious executables,” In Proceedings of the IEEE Symposiumon Security and Privacy, pp. 38–49, 2001.##
   [7]      G. Giacinto, R. Perdisci, M. D. Rio, and F. Roli, “Intrusion detection in computer networks by a modular ensemble of one-class classifiers,” Information Fusion, vol. 9, no. 1, pp. 69–82, 2008.##
   [8]      G. Giacinto, F. Roli, and L. Didaci, “Fusion of  multiple classifiers for intrusion detection in computer networks,” Pattern Recognition Letters, vol. 24, no. 12, pp.  1795–1803, 2003.##
   [9]       B. Zhang, J. Yin, S. Wang, and X. Yan, “Research on virus detection technique based on ensemble neural network and SVM,” Advanced Intelligent Computing Theories and Methodologies, vol. 137, pp. 24-33, 2014.##
[10]      S. M. AbdElrahman and A. Abraham, “Intrusion detection using error correcting output code based ensemble,” International Conference Hybrid Intelligent Systems (HIS), IEEE, pp. 181-186, 2014.##
[11]      M. Sreenath and J. Udhayan, “Intrusion detection system using Bagging Ensemble Selection,” International Conference Engineering and Technology (ICETECH), pp. 1-4, 2015.##
[12]      D. P. Gaikwad and R. C. Thool, “Intrusion detection System using bagging ensemble method of machine learning,” International Conference Computing Communication Control and Automation (ICCUBEA), pp. 291-295, 2015.##
[13]      P. Sornsuwit and S. Jaiyen, “Intrusion detection model based on ensemble learning for U2R and R2L attacks,” International Conference on Information Technology and Electrical Engineering (ICITEE), pp. 354-359, 2015.##
[14]      S. Masarat, H. Taheri, and S. Sharifian, “A novel framework, based on fuzzy ensemble of classifiers for intrusion detection systems,” International Conference Computer and Knowledge Engineering (ICCKE), pp.     165-170, 2014.##
[15]      M. Milliken, Y. Bi, L. Galway, and G. Hawe, “Ensemble learning utilising feature pairings for intrusion detection,” World Congress on Internet Security (WorldCIS), pp. 24-31, 2015.##
[16]      A. A. Aburomman and M. B. IbneReaz, “A novel SVM-kNN-PSO ensemble method for intrusion detection system,” Applied Soft Computing, vol. 38, pp. 360–372, 2016.##
[17]      R. Singha, H. Kumarb, and R. K. Singlac, “An intrusion detection system using network traffic profiling and online sequential extreme learning machine,” Expert Systems with Applications, vol. 42, pp. 8609–8624, 2015.##
[18]      R. M. Elbasiony, E. A. Sallam, T. E. Eltobely, and M. M. Fahmy, “A hybrid network intrusion detection framework based on random forests and weighted k-means,” Ain Shams Eng. J, vol. 4, pp. 753–762, 2013.##
[19]      D. Watson and J. Riden, “The honeynet project,” Technical Report, 2006.##
[20]      Members of the  Honeynet Project, “Know Your Enemy: Learning about Security Threats,” 2nd edn.             Addison-Wesley, Boston, 2004.##
[21]      N. Provos and T. Holz, “Virtual honeypots: from botnet tracking to intrusion detection,” 1st edn. Addison-Wesley Professional, Boston, 2007.##
[22]      L. Rokach, “Ensemble-based classifiers,’ Artificial Intelligence Review, vol. 33, pp. 1–39, 2010.##
[23]      R. Polikar, “Ensemble based systems in decision making,” Circuits and Systems Magazine, vol. 6, pp. 21–45, 2006.##
[24]      D. Opitz and R. Maclin, “Popular ensemble methods: An empirical study,” Journal of Artificial Intelligence Research, vol. 11, pp. 169–198, 1999.##
[25]      L. K. Hansen and P. Salamon, “Neural network ensembles,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 12, no. 10, pp. 993–1001, 1990.##
[26]      R. E. Schapire, “The strength of weak learnability,” Machine Learning, vol. 5, no. 2, pp. 197–227, 1990.##
[27]      Z. H. Zhou, “Ensemble methods: foundations and algorithms. machine learning & pattern recognition series,” Chapman & Hall/CRC, Boca Raton FL, 2012.##
[28]      B. M. Aslahi-Shahri, R. Rahmani, M. Chizari, A. Maralani, M. Eslami, M.J. Golkar, and A. Ebrahimi, “A hybrid method consisting of GA and SVM for intrusion detection system,” Neural Computing and Applications, pp. 1–8, 2015.##
[29]      S. Rastegari, P. Hingston, and C. P. Lam, “Evolving statistical rulesets for network intrusion detection,” Applied Soft Computing, vol. 33, pp. 348–359, 2015.##
[30]      R. Ghorbani and H. Abrishami, “Using Stereo Vision to Provide a Vision-Based Augmented Reality System,” Tabriz Journal of Electrical Eng., vol. 42, no. 1, 2012. (In Persian)##
[31]      S. Abdollahzadeh, M. A. Balafar, and L. Mohammad Khanli, “|Using Clustering and Markov Model in Predicting Web Users' Next Request,” Tabriz Journal of Electrical Eng., vol. 45, no. 3, 2014. (In Persian)##
[32]      F. H. Abbasi, R. J. Harris, S. Marsland, and G. Moretti, “An Exemplar-Based Learning Approach for Detection and Classification of Malicious Network Streams in Honeynets,” Security and Communication Networks, vol. 7, no. 2, pp. 352-364, 2014.##
 [33]      H. Parvin, S. Ansari, and S. Parvin, “Proposing a New Method for Non-Relative Imbalanced Dataset,” Soft Computing Models in Industrial and Environmental Applications, vol. 188, pp. 297-306, 2013.##
[34]      H. Parvin, B. Minaei, H. Alinejad-Rokny, and W. Punch, “Data weighing mechanisms for clustering ensembles,” Computers and Electrical Engineering, vol. 5. no. 39, pp. 1433–1450, 2013.##
[35]      R. K. Shahzad and N. Lavesson, “Comparative Analysis of Voting Schemes for Ensemble-based Malware Detection,” Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, vol. 4, no. 1, pp. 98-117, 2013.##
[36]      A. L. Buczak and E. Guven, “A survey of data mining and machine learning methods for cyber security intrusion detection,” IEEE Communications Surveys and Tutorials, vol. 18, no. 2, pp. 1153–1176, 2016.##
[37]      A. A. Aburomman and M. B. Ibne Reaz, “A novel SVM-Knnpso ensemble method for intrusion detection system,” Applied Soft Computing Journal, vol. 38, pp. 360–372, 2016.##
[38]      M. Li, S. Pan, Y. Zhang, and X. Cai, “Classifying networked text data with positive and unlabeled examples,” Pattern Recognition Letters, vol. 77, pp. 1–7, 2016.##
[39]      S. Parsa and M. Zeinipour, “Botnet Detection with Flow Behavior Analysis Approach,” Journal of Electrical & Cyber Defence, vol. 5, no. 4, pp. 35-50, 2017. (In Persian)##