Intrusion Detection System Application with Machine Learning

Yıl 2024, , 1165 - 1179, 01.10.2024

Mehmet Hacıbeyoglu , Ferda Nur Arıcı , Muhammed Karaaltun

https://doi.org/10.35414/akufemubid.1455995

Öz

Information security holds paramount importance for organizations and users alike, safeguarding against unauthorized access to sensitive data. Daily usage of the internet amplifies the importance of security measures and the detection of malicious activities. Cyber-attacks, as these malicious activities are commonly known, are continually evolving with advancements in hardware, software, and complex network algorithms. Intrusion Detection Systems play a crucial role in shielding data and information from cyberattacks. The rapid progression in machine learning and deep learning, two popular methodologies in data mining, has found applications in various fields, including security. This study focuses on the use of machine learning and deep learning methods to design an intelligent intrusion detection system. For the development of this smart intrusion detection system, two well-established datasets, NSL-KDD and Kyoto 2006+, were employed. Machine learning methods were implemented utilizing the classification algorithms available in the WEKA data mining tool. The results obtained from these classification algorithms were compared with the deep learning model designed within the scope of the study. Consequently, a detailed analysis of machine learning and deep learning methods on the NSL-KDD and Kyoto 2006+ datasets for an intelligent intrusion detection system was conducted, and suggestions were proposed for further research endeavors.

Anahtar Kelimeler

Deep learning, Intrusion detection system, Kyoto 2006+, Machine learning, NSL-KDD

Destekleyen Kurum

Necmettin Erbakan University Scientific Research Projects Coordination Unit

Proje Numarası

201219009

Makine Öğrenmesi ile Saldırı Tespit Sistemi Uygulaması

Öz

Bilgi güvenliği, her organizasyon ve kullanıcı için bilgilere yetkisiz erişime karşı koruma sağlamak açısından son derece önemlidir. İnternet, her gün geniş bir alanda kullanılmaktadır. Bu kullanım arttıkça, güvenlik ve kötü niyetli faaliyetleri tespit etmenin önemi de artmaktadır. Bu kötü niyetli faaliyetler, siber saldırılar olarak adlandırdığımız, donanım, yazılım ve karmaşık ağ algoritmalarının gelişimiyle gün geçtikçe değişmekte ve gelişmektedir. Saldırı tespit sistemleri, verileri veya bilgiyi siber saldırılardan korumada önemli bir rol oynamaktadır. Makine öğrenimi ve derin öğrenmedeki hızlı ilerlemeler, veri madenciliğinde popüler olan bu iki yöntemin güvenlik dâhil birçok alanda kullanılmasına neden olmaktadır. Bu çalışmada, akıllı bir saldırı tespit sistemi tasarımı için makine öğrenimi ve derin öğrenme yöntemleri üzerinde çalışılmıştır. Akıllı saldırı tespit sistemi tasarımı için literatürde iyi bilinen NSL-KDD ve Kyoto 2006+ olmak üzere iki veri seti kullanılmıştır. Makine öğrenimi yöntemleri, WEKA veri madenciliği aracındaki sınıflandırma algoritmaları kullanılarak gerçekleştirilmiştir. Sınıflandırma algoritmalarından elde edilen sonuçlar, çalışmanın kapsamında tasarlanan derin öğrenme modeli ile karşılaştırılmıştır. Böylece, makine öğrenimi ve derin öğrenme yöntemleri, akıllı bir saldırı tespit sistemi için NSL-KDD ve Kyoto 2006+ veri setleri üzerinde detaylı bir şekilde analiz edilmiş ve ileri çalışmalar için önerilerde bulunulmuştur.

Anahtar Kelimeler

Derin öğrenme, Kyoto 2006+, Makine öğrenmesi, NSL-KDD, Saldırı tespit sistemi

Destekleyen Kurum

Necmettin Erbakan Üniversitesi Bilimsel Araştırma Projeleri

Proje Numarası

201219009

Kaynakça

• Ahmad, Z., Shahid Khan, A., Wai Shiang, C., Abdullah, J. and Ahmad, F., 2021. Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32(1), e4150 https://doi.org/10.1002/ett.4150
• Al Shalabi, L., and Shaaban, Z., 2006. Normalization as a preprocessing engine for data mining and the approach of preference matrix. In 2006 International conference on dependability of computer systems, 207-214. https://doi.org/10.1109/DEPCOS-RELCOMEX.2006.38
• Anuse, A. and Vyas, V., 2016. A novel training algorithm for convolutional neural network. Complex & Intelligent Systems, 2(3), 221-234. https://doi.org/10.1007/s40747-016-0024-6
• Bakro, M., Kumar, R. R., Husain, M., Ashraf, Z., Ali, A., Yaqoob, S. I., ... and Parveen, N., 2024. Building a Cloud-IDS by Hybrid Bio-Inspired Feature Selection Algorithms Along With Random Forest Model. IEEE Access, 12, 8846 - 8874. https://doi.org/10.1109/ACCESS.2024.3353055
• Budak, H., 2018. Özellik seçim yöntemleri ve yeni bir yaklaşım. Süleyman Demirel Üniversitesi Fen Bilimleri Enstitüsü Dergisi, 22, 21-31.
• Chary, S. N. and Rama, B., 2017. A survey on comparative analysis of decision tree algorithms in data mining. International Journal of Advanced Scientific Technologies, Engineering and Management Sciences, 3(1), 91-95.
• Chitrakar, R. and Huang, C., 2014. Selection of candidate support vectors in incremental SVM for network intrusion detection. Computers & Security, 45, 231-241. https://doi.org/10.1016/j.cose.2014.06.006
• Datti, R. and Verma, B., 2010. Feature reduction for intrusion detection using linear discriminant analysis. International Journal on Engineering Science and Technology, 2(4), 1072-1078.
• Dhanabal, L. and Shantharajah, S. P. (2015). A study on NSL-KDD dataset for intrusion detection system based on classification algorithms. International Journal of Advanced Research in Computer and Communication Engineering, 4(6), 446-452.
• Diro, A. A. and Chilamkurti, N., 2018. Distributed attack detection scheme using deep learning approach for Internet of Things. Future Generation Computer Systems, 82, 761-768. https://doi.org/10.1016/j.future.2017.08.043
• Dong, B. and Wang, X., 2016. Comparison deep learning method to traditional methods using for network intrusion detection. In 2016 8th IEEE international conference on communication software and networks (ICCSN), 581-585.
• Dong, Y., 2018. An application of deep neural networks to the in-flight parameter identification for detection and characterization of aircraft icing. Aerospace Science and Technology, 77, 34-49. https://doi.org/10.1016/j.ast.2018.02.026
• Du, J., Yang, K., Hu, Y. and Jiang, L., 2023. NIDS-CNNLSTM: Network intrusion detection classification model based on deep learning. IEEE Access, 11, 24808-24821. https://doi.org/10.1109/ACCESS.2023.3254915
• Duan, L., Han, D. and Tian, Q., 2019. Design of intrusion detection system based on improved ABC_elite and BP neural networks. Computer Science and Information Systems, 16(3), 773-795. https://doi.org/10.2298/CSIS181001026D
• El Aboudi, N. and Benhlima, L., 2016. Review on wrapper feature selection approaches. In 2016 international conference on engineering & MIS (ICEMIS), 1-5.
• Gorunescu, F., 2011. Data Mining: Concepts, models and techniques, 12, Springer Science & Business Media.
• Guan, S. U., Liu, J. and Qi, Y., 2004. An incremental approach to contribution-based feature selection. Journal of Intelligent Systems, 13(1), 15-42. https://doi.org/10.1515/JISYS.2004.13.1.15
• Gurung, S., Ghose, M. K. and Subedi, A., 2019. Deep learning approach on network intrusion detection system using NSL-KDD dataset. International Journal of Computer Network and Information Security, 3, 8-14. htttps://doi.org/10.5815/ijcnis.2019.03.0
• Guyon, I. and Elisseeff, A., 2003. An introduction to variable and feature selection. Journal of machine learning research, 3, 1157-1182.
• Hodge, V. J., O’Keefe, S. and Austin, J., 2006. A binary neural decision table classifier. Neurocomputing, 69(16), 1850-1859. https://doi.org/10.1016/j.neucom.2005.11.012
• Kabir, M. M., Islam, M. M. and Murase, K., 2010. A new wrapper feature selection approach using neural network. Neurocomputing, 73(16-18), 3273-3283. https://doi.org/10.1016/j.neucom.2010.04.003
• Kasongo, S. M., 2023. A deep learning technique for intrusion detection system using a Recurrent Neural Networks based framework. Computer Communications, 199, 113-125. https://doi.org/10.1016/j.comcom.2022.12.010
• Khan, M., Ding, Q. and Perrizo, W., 2002. K-nearest neighbor classification on spatial data streams using P-trees. In Pacific-Asia Conference on Knowledge Discovery and Data Mining, 517-528. https://doi.org/10.1007/3-540-47887-6_51
• Khraisat, A., Gondal, I. and Vamplew, P., 2018. An anomaly intrusion detection system using C5 decision tree classifier. In Trends and Applications in Knowledge Discovery and Data Mining: PAKDD 2018. https://doi.org/10.1007/978-3-030-04503-6_14
• Kim, G., Lee, S. and Kim, S., 2014. A novel hybrid intrusion detection method integrating anomaly detection with misuse detection. Expert Systems with Applications, 41(4), 1690-1700. https://doi.org/10.1016/j.eswa.2013.08.066
• Krose, B. and Smagt, P. V. D., 1996. An introduction to neural networks. Journal of Computer Science, (48).
• Ladha, L. and Deepa, T., 2011. Feature selection methods and algorithms. International Journal on Computer Science and Engineering, 3(5), 1787-1797.
• Marill, T. and Green, D., 1963. On the effectiveness of receptors in recognition systems. IEEE transactions on Information Theory, 9(1), 11-17. https://doi.org/10.1109/TIT.1963.1057810
• Meena, G. and Choudhary, R. R., 2017. A review paper on IDS classification using KDD 99 and NSL KDD dataset in WEKA. In 2017 International Conference on Computer, Communications and Electronics, 553-558. https://doi.org/10.1109/COMPTELIX.2017.8004032
• Mohsen, H., El-Dahshan, E. S. A., El-Horbaty, E. S. M. and Salem, A. B. M., 2018. Classification using deep learning neural networks for brain tumors. Future Computing and Informatics Journal, 3(1), 68-71. https://doi.org/10.1016/j.fcij.2017.12.001
• Oğuzlar, A., 2003. Veri ön işleme. Erciyes Üniversitesi İktisadi ve İdari Bilimler Fakültesi Dergisi, (21).
• Park, K., Song, Y. and Cheong, Y. G., 2018. Classification of attack types for intrusion detection systems using a machine learning algorithm. In 2018 IEEE fourth international conference on big data computing service and applications, 282-286. https://doi.org/10.1109/BigDataService.2018.00050
• Patro, S. and Sahu, K. K., 2015. Normalization: A preprocessing stage. arXiv preprint. https://doi.org/10.48550/arXiv.1503.06462
• Prasad, R. and Rohokale, V., 2020. Artificial intelligence and machine learning in cyber security. Cyber security: the lifeline of information and communication technology, 231-247. https://doi.org/10.1007/978-3-030-31703-4_16
• Pudil, P., Novovičová, J. and Kittler, J., 1994. Floating search methods in feature selection. Pattern recognition letters, 15(11), 1119-1125. https://doi.org/10.1016/0167-8655(94)90127-9
• Puzis, R., Klippel, M. D., Elovici, Y. and Dolev, S., 2008. Optimization of NIDS placement for protection of intercommunicating critical infrastructures. In European Conference on Intelligence and Security Informatics, 191-203. https://doi.org/10.1007/978-3-540-89900-6_20
• Qassim, Q., Zin, A. M. and Ab Aziz, M. J., 2016. Anomalies Classification Approach for Network-based Intrusion Detection System. International Journal of Network Security, 18(6), 1159-1172.
• Revathi, S. and Malathi, A., 2013. A detailed analysis on NSL-KDD dataset using various machine learning techniques for intrusion detection. International Journal of Engineering Research & Technology (IJERT), 2(12), 1848-1853.
• Rish, I., 2001. An empirical study of the naive Bayes classifier. In IJCAI 2001 workshop on empirical methods in artificial intelligence, 3(22), 41-46.
• Rojas, R., 2013. Neural networks: a systematic introduction. Springer Science & Business Media.
• Sahani, R., Shatabdinalini, Rout, C., Chandrakanta Badajena, J., Jena, A. K. and Das, H., 2018. Classification of intrusion detection using data mining techniques. In Progress in Computing, Analytics and Networking: Proceedings of ICCAN 2017, 753-764. https://doi.org/10.1007/978-981-10-7871-2_72
• Sahu, S. and Mehtre, B. M., 2015. Network intrusion detection system using J48 Decision Tree. In 2015 International Conference on Advances in Computing, Communications and Informatics (ICACCI), 2023-2026. https://doi.org/10.1109/ICACCI.2015.7275914
• Sarker, I. H. (2021). Deep cybersecurity: a comprehensive overview from neural network and deep learning perspective. SN Computer Science, 2(3), 154. https://doi.org/10.1007/s42979-021-00535-6
• Shone, N., Ngoc, T. N., Phai, V. D. and Shi, Q., 2018. A deep learning approach to network intrusion detection. IEEE transactions on emerging topics in computational intelligence, 2(1), 41-50. https://doi.org/10.1109/TETCI.2017.2772792
• Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D. and Nakao, K., 2011. Statistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation. In Proceedings of the first workshop on building analysis datasets and gathering experience returns for security, 29-36. https://doi.org/10.1145/1978672.1978676
• Srivastava, N., Hinton, G., Krizhevsky, A., Sutskever, I. and Salakhutdinov, R., 2014. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research, 15, 1929-1958.
• Stolfo, S. J., Fan, W., Lee, W., Prodromidis, A. and Chan, P. K., 2000. Cost-based modeling for fraud and intrusion detection: Results from the JAM project. In Proceedings DARPA Information Survivability Conference and Exposition, 130-144. https://doi.org/10.1109/DISCEX.2000.821515
• Swathi, K. and Rao, B. B., 2019. Impact of PDS based kNN classifiers on Kyoto dataset. International Journal of Rough Sets and Data Analysis (IJRSDA), 6(2), 61-72. http://dx.doi.org/10.4018/IJRSDA.2019040105
• Tavallaee, M., Bagheri, E., Lu, W. and Ghorbani, A. A., 2009. A detailed analysis of the KDD CUP 99 data set. In 2009 IEEE symposium on computational intelligence for security and defense applications, 1-6. https://doi.org/10.1109/CISDA.2009.5356528
• Vasilomanolakis, E., Karuppayah, S., Mühlhäuser, M. and Fischer, M., 2015. Taxonomy and survey of collaborative intrusion detection. ACM computing surveys, 47(4), 1-33. https://doi.org/10.1145/2716260
• Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A. and Venkatraman, S., 2019. Deep learning approach for intelligent intrusion detection system. IEEE Access, 7, 41525-41550. https://doi.org/10.1109/ACCESS.2019.2895334
• Wei, L., Ding, Y., Su, R., Tang, J. and Zou, Q., 2018. Prediction of human protein subcellular localization using deep learning. Journal of Parallel and Distributed Computing, 117, 212-217. https://doi.org/10.1016/j.jpdc.2017.08.009
• Whitney, A. W., 1971. A direct method of nonparametric measurement selection. IEEE transactions on computers, 100(9), 1100-1103. https://doi.org/10.1109/T-C.1971.223410
• Witlox, F., Antrop, M., Bogaert, P., De Maeyer, P., Derudder, B., Neutens, T., ... and Van de Weghe, N. , 2009. Introducing functional classification theory to land use planning by means of decision tables. Decision Support Systems, 46(4), 875-881. https://doi.org/10.1016/j.dss.2008.12.001
• Yan, K., Ma, L., Dai, Y., Shen, W., Ji, Z. and Xie, D., 2018. Cost-sensitive and sequential feature selection for chiller fault detection and diagnosis. International Journal of Refrigeration, 86, 401-409. https://doi.org/10.1016/j.ijrefrig.2017.11.003
• Zakariah, M., AlQahtani, S. A., Alawwad, A. M. and Alotaibi, A. A., 2023. Intrusion Detection System with Customized Machine Learning Techniques for NSL-KDD Dataset. Computers, Materials & Continua, 77(3). 4025-4054 https://doi.org/10.32604/cmc.2023.043752
• Zhang, X. and Liu, C. A. (2023). Model averaging prediction by K-fold cross-validation. Journal of Econometrics, 235(1), 280-301. https://doi.org/10.1016/j.jeconom.2022.04.007
• Zhang, Y., Cao, G., Wang, B. and Li, X., 2019. A novel ensemble method for k-nearest neighbor. Pattern Recognition, 85, 13-25. https://doi.org/10.1016/j.patcog.2018.08.003
• Zhu, Z., Ong, Y. S. and Dash, M., 2007. Wrapper–filter feature selection algorithm using a memetic framework. IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics), 37(1), 70-76. https://doi.org/10.1109/TSMCB.2006.883267