A Class-Specific Intrusion Detection Model: Hierarchical Multi-class IDS Model

Date

2020-06-01

Author

Sarıkaya, Alper
Günel Kılıç, Banu

Metadata

Show full item record

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Item Usage Stats

38
views

0
downloads

Nowadays, cyberattacks are occurring continuously. There are many kinds of attack types, which are malicious and harmful for our networks, resources and privacy. Along with this, diversity, size and density of the cyberattacks are increasing. Therefore, strong and solid detection mechanisms are required to prevent the cyberattacks. Previously, many intrusion detection mechanisms are proposed, but many of them are suffered to detect some attack classes. In this paper, an up-to-date and realistic dataset called UNSW-NB15 was used for training of an intrusion detection system. The dataset contains network data under nine different attack scenarios as well as normal operation. Firstly, wrapper feature selection was applied to the dataset, which reduced the number of features to 19 features from 43. Secondly, a decision tree classifier was trained with reduced dataset. The confusion matrix was tabulated and classes with low detection rates were identified. Finally, to achieve better detection rates for Dos, Exploit and Fuzzers classes which were low detected classes, a hierarchical multi-class classifier was proposed. As the basis of the model, random forest classifier was selected, where each classifier at a different stage of the hierarchy has a specific attack detection purpose. The proposed system achieved better overall classification accuracy of 80.78% than the baseline random forest classifier. The detection rates for DoS, Exploit and Fuzzers attacks were also increased.

URI

https://link.springer.com/content/pdf/10.1007/s42979-020-00213-z.pdf
https://hdl.handle.net/11511/92790

Journal

SN Computer Science

DOI

https://doi.org/10.1007/s42979-020-00213-z

Collections

Graduate School of Informatics, Article

Suggestions

OpenMETU
Core

Anomaly-based cyber intrusion detection system with ensemble classifier Sarıkaya, Alper; Günel Kılıç, Banu; Department of Information Systems (2018) Nowadays, cyberattacks are occurring progressively. Along with this, diversity, size and density of the cyberattacks are increasing. When the logs of security devices are analyzed, massive amounts of attack signs are detained. Besides, it is also difficult for humans to evaluate the logs accurately. Therefore, the identification of key data, which can be used to distinguish an attack from this very large data set, is important for both rapid detection of attacks and rapid response of security devices. This ...
Yalancı Renk Kullanımı ile Görsel Mahremiyetin Korunumu Akyüz, Ahmet Oğuz(2017-01-01) Yalancı renklendirme yaklasımı kullanılarak görüntülerin bozulmasıyla elde edilen korunmus görüntünün, gerek insanlar tarafından gerekse de yüz tanıma algoritmaları kullanan bilgisayarlar tarafından tanınırlıgı zorlastırdıgı ve mevcut koruma yöntmelerine nazaran daha iyi koruma yapabildigi gözlemlenmistir. Bu çalısmayla, sabit görüntüler ve video dosyaları üzerinden sübjektif ve objektif degerlendirmeler yapılarak yalancı renklendirme yöntemiyle güvenlik kameralarının islevini yitirmeden mahremiyetin korunm...
An incremental constraint satisfaction algorithm for dynamic reconfiguration Entekhabi, Sina; Karataş, Ahmet Serkan; Oğuztüzün, Mehmet Halit S. (null; 2017-05-08) Dynamically reconfigurable systems are able to respond to changes in their operational environment by reconfiguring themselves automatically. Dynamic software product lines are dynamically reconfigurable systems with an explicit model of variability, which plays a key role in the reconfiguration process. In our work we use feature models for modeling variability. Features are mapped to the system’s components that realize them. The feature model corresponds to a constraint logic program, and determines the ...
A new approach for the scalable intrusion detection in high-speed networks Şahin, Ümit Burak; Schmidt, Şenan Ece; Department of Electrical and Electronics Engineering (2007) As the networks become faster and faster, the emerging requirement is to improve the performance of the Intrusion Detection and Prevention Systems (IDPS) to keep up with the increased network throughput. In high speed networks, it is very difficult for the IDPS to process all the packets. Since the throughput of IDPS is not improved as fast as the throughput of the switches and routers, it is necessary to develop new detection techniques other than traditional techniques. In this thesis we propose a rule-ba...
A Hybrid Approach for Credibility Detection in Twitter Gun, Alper; Karagöz, Pınar (2014-06-13) Nowadays, microblogging services are seen as a source of information. It brings us a question. Can we trust information in a microblogging service? In this paper, we focus on one of the popular microblogging services, Twitter, and try to answer which information in Twitter is credible. Newsworthiness, importance and correctness are the dimensions to be measured in this study. We propose a hybrid credibility analysis which combines feature based and graph based approaches. Our model is based on three types o...

Citation Formats

A. Sarıkaya and B. Günel Kılıç, “A Class-Specific Intrusion Detection Model: Hierarchical Multi-class IDS Model,” SN Computer Science, vol. 1, no. 202, pp. 1–11, 2020, Accessed: 00, 2021. [Online]. Available: https://link.springer.com/content/pdf/10.1007/s42979-020-00213-z.pdf.