بررسی یک روش ترکیبی جدید سیستم تشخیص نفوذ بر روی مجموعه داده های مختلف

نوع مقاله : مقاله پژوهشی

نویسنده

پردیس صنعتی شهدای هویزه، دانشگاه شهید چمران اهواز، اهواز، ایران.

چکیده

تشخیص نفوذ یک مسئله طبقه‌بندی است که در آن روش‌های مختلف یادگیری ماشین (ML) و داده‌کاوی (DM) برای طبقه‌بندی داده‌های شبکه در ترافیک عادی و حمله استفاده می‌شود. علاوه بر این، انواع حملات شبکه در طول سال‌ها تغییر کرد. در این مقاله سعی شد دو مدل از سیستم‌های تشخیص نفوذ، باهم مقایسه شود، که این مدل‌ها شامل، شبکه استنتاج عصبی-فازی سازگار (ANFIS) و ماشین‌های بردار پشتیبان (SVM) می‌باشند. علاوه بر این چندین نمونه از مجموعه داده‌های مربوط به سیستم‌های تشخیص نفوذ را موردبررسی و ارزیابی قرار می‌دهد. در ادامه، یک روش ترکیبی جدید را بیان می‌کند که از بهینه‌سازی ازدحام ذرات (PSO) به‌منظور ایجاد ترکیب دسته‌بندها برای ایجاد دقت بهتر برای تشخیص نفوذ، استفاده کرده است. نتایج آزمایش نشان می‌دهد که روش جدید می‌تواند کارایی بهتری بر اساس معیارهای مختلف ارزیابی، ارائه کند. این مقاله مجموعه داده‌های مختلف را برای ارزیابی مدل IDS فهرست می‌کند و کارایی روش ترکیبی پیشنهادی بر مجموعه داده‌های IDS را موردبحث قرار می‌دهد که می‌تواند برای استفاده از مجموعه داده‌ها برای توسعه IDS مبتنی بر ML و DM کارآمد و مؤثر بوده و مورداستفاده قرار گیرد.

کلیدواژه‌ها


عنوان مقاله [English]

Investigation of a new ensemble method of intrusion detection system on different data sets

نویسنده [English]

  • Mohammad Hassan Nataj Solhdar
Shohadaye Hoveizeh Campus of Technology, Shahid Chamran University of Ahvaz, Dashte Azadegan, Susangerd, Iran .
چکیده [English]

Intrusion detection is a classification problem in which various machine learning (ML) and data mining (DM) techniques are used to classify network data in normal traffic and attack. In addition, the types of network attacks have changed over the years. This paper tries to compare two models of intrusion detection systems, which include adaptive neuro-fuzzy inference systems (ANFIS) and support vector machines (SVM). In addition, it examines and evaluates several instances of data sets related to intrusion detection systems. In the following, a new hybrid method is proposed that uses Particle Swarm Optimization (PSO) to create a classifier combination to provide better accuracy for intrusion detection. Experimental results show that the new method can produce a better performance based on different evaluation criteria. This paper lists the different datasets for evaluating the IDS model and discusses the performance of the proposed hybrid method on the IDS datasets that can be used to efficiently and effectively use the datasets to develop IDS based on ML and DM.

کلیدواژه‌ها [English]

  • Intrusion detection system
  • adaptive neuro-fuzzy inference system
  • support vector machines
  • classifier

Smiley face

[1]    S. Akbar, K. N. Rao, & J. Chandulal, "Intrusion detection system methodologies based on data analysis," International Journal of Computer Applications, vol. 5, no. 2, pp. 10-20, 2010.
[2]    T. Ahmad & M. N. Aziz, "Data preprocessing and feature selection for machine learning intrusion detection systems," ICIC Express Lett, vol. 13, no. 2, pp. 93-101, 2019.
[3]    B. A. Tama, M. Comuzzi, & K.-H. Rhee, "TSE-IDS: A two-stage classifier ensemble for intelligent anomaly-based intrusion detection system," IEEE Access, vol. 7, pp. 94497-94507, 2019.
[4]    Z. Chiba, N. Abghour, K. Moussaid, & M. Rida, "Intelligent approach to build a Deep Neural Network based IDS for cloud environment using combination of machine learning algorithms," computers & security, vol. 86, pp. 291-317, 2019.
[5]    H. Liu & B. Lang, "Machine learning and deep learning methods for intrusion detection systems: A survey," applied sciences, vol. 9, no. 20, p. 4396, 2019.
[6]    R. Koch, M. Golling, & G. D. Rodosek, "Towards comparability of intrusion detection systems: New data sets," in TERENA Networking Conference, vol. 7, 2014.
[7]    A. Shiravi, H. Shiravi, M. Tavallaee, & A. A. Ghorbani, "Toward developing a systematic approach to generate benchmark datasets for intrusion detection," computers & security, vol. 31, no. 3, pp. 357-374, 2012.
[8]    H. Hindy et al., "A taxonomy and survey of intrusion detection system design techniques, network threats and datasets," 2018.
[9]    A. Thakkar & R. Lohiya, "A survey on intrusion detection system: feature selection, model, performance measures, application perspective, challenges, and future research directions," Artificial Intelligence Review, pp. 1-111, 2021.
[10]  I. S. Thaseen, C. A. Kumar, & A. Ahmad, "Integrated intrusion detection model using chi-square feature selection and ensemble of classifiers," Arabian Journal for Science and Engineering, vol. 44, no. 4, pp. 3357-3368, 2019.
[11]  Y. Shen, K. Zheng, C. Wu, M. Zhang, X. Niu, & Y. Yang, "An ensemble method based on selection using bat algorithm for intrusion detection," The Computer Journal, vol. 61, no. 4, pp. 526-538, 2018.
[12]  J. Kennedy, "Swarm intelligence," in Handbook of nature-inspired and innovative computing: Springer, pp. 187-219, 2006.
[13]  C. Khammassi & S. Krichen, "A GA-LR wrapper approach for feature selection in network intrusion detection," computers & security, vol. 70, pp. 255-277, 2017.
[14]  S. Parsa & s. H. R. Aarabi, "A New Approach to Network Intrusion Detection Based on Hybrid Methods," Scientific Journal of Electronic and Cyber Defense, vol. 5, no. 3, pp. 79-93, 2017. (Persian in)
[15]  M. Abdullah, A. Alshannaq, A. Balamash, & S. Almabdy, "Enhanced intrusion detection system using feature selection method and ensemble learning algorithms," International Journal of Computer Science and Information Security (IJCSIS), vol. 16, no. 2, pp. 48-55, 2018.
[16]  I. F. Kilincer, F. Ertam, & A. Sengur, "Machine learning methods for cyber security intrusion detection: Datasets and comparative study," Computer Networks, vol. 188, p. 107840, 2021.
[17]  W. Wang, X. Zhang, & S. Gombault, "Constructing attribute weights from computer audit data for effective intrusion detection," Journal of Systems and Software, vol. 82, no. 12, pp. 1974-1981, 2009.
[18]  F. Salo, A. B. Nassif, & A. Essex, "Dimensionality reduction with IG-PCA and ensemble classifier for network intrusion detection," Computer Networks, vol. 148, pp. 164-175, 2019.
[19]  M. A. Khan, M. Karim, & Y. Kim, "A scalable and hybrid intrusion detection system based on the convolutional-LSTM network," Symmetry, vol. 11, no. 4, p. 583, 2019.
[20]  Y. Zhong et al., "HELAD: A novel network anomaly detection model based on heterogeneous ensemble learning," Computer Networks, vol. 169, p. 107049, 2020.
[21]  I. Syarif, E. Zaluska, A. Prugel-Bennett, & G. Wills, "Application of bagging, boosting and stacking to intrusion detection," in International Workshop on Machine Learning and Data Mining in Pattern Recognition, pp. 593-602, Springer. 2012.
[22]  A. J. Malik, W. Shahzad, & F. A. Khan, "Network intrusion detection using hybrid binary PSO and random forests algorithm," Security and Communication Networks, vol. 8, no. 16, pp. 2646-2660, 2015.
[23]  N. T. Pham, E. Foo, S. Suriadi, H. Jeffrey, & H. F. M. Lahza, "Improving performance of intrusion detection system using ensemble methods and feature selection," in Proceedings of the Australasian Computer Science Week Multiconference, pp. 1-6, 2018.
[24]  A. Maroosi, E. Zabbah, & H. Ataei Khabbaz, "Network Intrusion Detection using a combination of artificial neural networks in a hierarchical manner," Scientific Journal of Electronic and Cyber Defense, vol. 8, no. 1, pp. 89-99, 2020. (in Persian)
[25]  V. Bukhtoyarov & V. Zhukov, "Ensemble-Distributed Approach in Classification Problem Solution for Intrusion Detection Systems," Cham, 2014: Springer International Publishing, in Intelligent Data Engineering and Automated Learning – IDEAL 2014, pp. 255-265, 2014.
[26]  N. Mohd, A. Singh, and H. S. Bhadauria, "A Novel SVM Based IDS for Distributed Denial of Sleep Strike in Wireless Sensor Networks," Wireless Personal Communications, vol. 111, no. 3, pp. 1999-2022, 2020.
[27]  M. Begli & F. Derakhshan, "A multiagent based framework secured with layered SVM-based IDS for remote healthcare systems," arXiv preprint arXiv:2104.06498, 2021.
[28]  H. Zolfi, H. Ghorbani, & M. H. Ahmadzadegan, "Investigation and classification of cyber-crimes through IDS and SVM algorithm," in 2019 Third International conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud)(I-SMAC), pp. 180-187, 2019.
[29]  M. Masdari & H. Khezri, "A survey and taxonomy of the fuzzy signature-based Intrusion Detection Systems," Applied Soft Computing, pp. 106-301, 2020.
[30]  S. Manimurugan, A.-q. Majdi, M. Mohmmed, C. Narmatha, & R. Varatharajan, "Intrusion detection in networks using crow search optimization algorithm with adaptive neuro-fuzzy inference system," Microprocessors and Microsystems, vol. 79, p. 103261, 2020.
[31]  M. Negnevitsky, "Artificial intelligence : a guide to intelligent systems / Michael Negnevitsky," (no. Accessed from https://nla.gov.au/nla.cat-vn3803044), New York: Addison-Wesley, 2005.
[32]  J.S. Jang, "ANFIS: adaptive-network-based fuzzy inference system," IEEE transactions on systems, man, and cybernetics, vol. 23, no. 3, pp. 665-685, 1993.
[33]  F. Kuang, W. Xu, & S. Zhang, "A novel hybrid KPCA and SVM with GA model for intrusion detection," Applied Soft Computing, vol. 18, pp. 178-184, 2014.
[34]  S.-J. Horng et al., "A novel intrusion detection system based on hierarchical clustering and support vector machines," Expert Systems with Applications, vol. 38, no. 1, pp. 306-313, 2011.
[35]  R. Eberhart & J. Kennedy, "A new optimizer using particle swarm theory," in MHS'95. Proceedings of the Sixth International Symposium on Micro Machine and Human Science, pp. 39-43, 1995, IEEE.
[36]  R. K. Vigneswaran, R. Vinayakumar, K. Soman, & P. Poornachandran, "Evaluating shallow and deep neural networks for network intrusion detection systems in cyber security," in 2018 9th International conference on computing, communication and networking technologies (ICCCNT), pp. 1-6, 2018, IEEE.
[37]  C. Brown, A. Cowperthwaite, A. Hijazi, & A. Somayaji, "Analysis of the 1999 darpa/lincoln laboratory ids evaluation data with netadhict," in 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp. 1-7, 2009, IEEE.
[38]  R. Bala & R. Nagpal, "A review on kdd cup99 and nsl nsl-kdd dataset," International Journal of Advanced Research in Computer Science, vol. 10, no. 2, 2019.
[39]  M. Tavallaee, E. Bagheri, W. Lu, & A. A. Ghorbani, "A detailed analysis of the KDD CUP 99 data set," in 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp. 1-6, 2009, IEEE.
[40]  H. Ji, D. Kim, D. Shin, & D. Shin, "A study on comparison of KDD CUP 99 and NSL-KDD using artificial neural network," in Advances in computer science and ubiquitous computing: Springer, pp. 452-457, 2017.
[41]  I. Sharafaldin, A. Gharib, A. H. Lashkari, & A. A. Ghorbani, "Towards a reliable intrusion detection benchmark dataset," Software Networking, vol. 2018, no. 1, pp. 177-200, 2018.
[42]  O. Yavanoglu & M. Aydos, "A review on cyber security datasets for machine learning algorithms," in 2017 IEEE international conference on big data (big data), pp. 2186-2193, 2017.
[43]  S. Peisert et al., "Lbnl open power data," 2017.
[44]  B. Sangster et al., "Toward Instrumenting Network Warfare Competitions to Generate Labeled Datasets," in CSET, 2009.
[45]  M. Sato, H. Yamaki, & H. Takakura, "Unknown attacks detection using feature extraction from anomaly-based ids alerts," in 2012 IEEE/IPSJ 12th International Symposium on Applications and the Internet, pp. 273-277, 2012. 
[46]  R. Chitrakar & C. Huang, "Anomaly based intrusion detection using hybrid learning approach of combining k-medoids clustering and naive Bayes classification," in 2012 8th International Conference on Wireless Communications, Networking and Mobile Computing, pp. 1-5, 2012.
[47]  J. Song, H. Takakura, Y. Okabe, M. Eto, D. Inoue, & K. Nakao, "Statistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation," in Proceedings of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, pp. 29-36, 2011. 
[48]  A. Sperotto, R. Sadre, F. Van Vliet, and A. Pras, "A labeled data set for flow-based intrusion detection," in International Workshop on IP Operations and Management, pp. 39-52, 2009.
[49]  "UMASS",http://traces.cs.umass.edu/index.php/Network/Network.
[50]  M. Nasr, A. Bahramali, and A. Houmansadr, "Deepcorr: Strong flow correlation attacks on Tor using deep learning," in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1962-1976, 2018.
[51]  G. Bissias, B. N. Levine, M. Liberatore, and S. Prusty, "Forensic Identification of Anonymous Sources in OneSwarm," IEEE Transactions on Dependable and Secure Computing, vol. 14, no. 6, pp. 620-632, 2017.
[52]  G. Creech and J. Hu, "Generation of a new IDS test dataset: Time to retire the KDD collection," in 2013 IEEE Wireless Communications and Networking Conference (WCNC), pp. 4487-4492, 2013.
[53]  T. Mouttaqi, T. Rachidi, and N. Assem, "Re-evaluation of combined Markov-Bayes models for host intrusion detection on the ADFA dataset," in 2017 Intelligent Systems Conference (IntelliSys), pp. 1044-1052, 2017.
[54]  Y. Shi and R. Eberhart, "A modified particle swarm optimizer," in 1998 IEEE international conference on evolutionary computation proceedings. IEEE world congress on computational intelligence (Cat. No. 98TH8360), pp. 69-73, 1998.
[55]  A. Gharib, I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, "An evaluation framework for intrusion detection dataset," in 2016 International Conference on Information Science and Security (ICISS), pp. 1-6, 2016.
[56]  M. Panda, A. Abraham, and M. R. Patra, "Discriminative multinomial naive bayes for network intrusion detection," in 2010 Sixth International Conference on Information Assurance and Security, pp. 5-10, 2010.
[57]  M. A. Salama, H. F. Eid, R. A. Ramadan, A. Darwish, and A. E. Hassanien, "Hybrid intelligent intrusion detection scheme," in Soft computing in industrial applications, pp. 293-303, 2011.
[58]  P. Gogoi, M. H. Bhuyan, D. Bhattacharyya, and J. K. Kalita, "Packet and flow based network intrusion dataset," in International Conference on Contemporary Computing, pp. 322-334, 2012.
[59]  E. De La Hoz, A. Ortiz, J. Ortega, and E. De la Hoz, "Network anomaly classification by support vector classifiers ensemble and non-linear projection techniques," in International Conference on Hybrid Artificial Intelligence Systems, pp. 103-111, 2013.
[60]  Z. Tan, A. Jamdagni, X. He, P. Nanda, R. P. Liu, and J. Hu, "Detection of denial-of-service attacks based on computer vision techniques," IEEE transactions on computers, vol. 64, no. 9, pp. 2519-2553, 2014.
[61]  M. G. Raman, N. Somu, K. Kirthivasan, R. Liscano, and V. S. Sriram, "An efficient intrusion detection system based on hypergraph-Genetic algorithm for parameter optimization and feature selection in support vector machine," Knowledge-Based Systems, vol. 134, pp. 1-12, 2017.
[62]  H. Huang, R. S. Khalid, and H. Yu, "Distributed machine learning on smart-gateway network towards real-time indoor data analytics," in Data Science and Big Data: An Environment of Computational Intelligence, pp. 231-263, 2017.
[63]  R. Singh, H. Kumar, and R. Singla, "An intrusion detection system using network traffic profiling and online sequential extreme learning machine," Expert Systems with Applications, vol. 42, no. 22, pp. 8609-8624, 2015.
[64]  M. Jabbar and R. Aluvalu, "RFAODE: A novel ensemble intrusion detection system," Procedia computer science, vol. 115, pp. 226-234, 2017.
[65]  J. Bao, R. Li, Y. Liu, Y. Liu, and B. Shao, "Ionospheric anomaly detection to support the BDSBAS," IEEE Access, vol. 8,  pp. 1691-1704, 2019.
[66]  A. Bansal and S. Kaur, "Extreme gradient boosting based tuning for classification in intrusion detection systems," in International conference on advances in computing and data sciences, pp. 372-380, 2018.
[67]  M. Catillo, M. Rak, and U. Villano, "Discovery of DoS attacks by the ZED-IDS anomaly detector," Journal of High Speed Networks, vol. 25, no. 4, pp. 349-365, 2019.
دوره 10، شماره 3 - شماره پیاپی 39
شماره پیاپی 39، فصلنامه پاییز
دی 1401
صفحه 43-57
  • تاریخ دریافت: 19 مهر 1400
  • تاریخ بازنگری: 18 آذر 1400
  • تاریخ پذیرش: 18 مرداد 1401
  • تاریخ انتشار: 01 دی 1401