Makine öğrenme yöntemleri ile ağ trafik analizi

Yıl 2022, , 862 - 870, 14.10.2022

Bülent Tuğrul , Adil Shihab Ahmed Ahmed

https://doi.org/10.28948/ngumuh.1113956

Öz

Saldırı Tespit Sistemleri (STS) ağa yapılan saldırıları ağ yöneticilerine bildirmek için kullanılan tekniklerden biridir. Her ne kadar çeşitli anomali tespit teknikleri geliştirilmiş olsa da, bu alanda yüksek veri boyutsallığı, hesaplama karmaşıklığı üzerindeki etki, ve hesaplama süresi gibi zorluklar ve sorunlar bulunmaktadır. Bunun yanı sıra saldırı tespit sistemlerinin yanlış alarm vermeleri de anomali trafik tespit sorunlarından biri olmakta, bu sorunları aşmak için makine öğrenme yöntemlerine başvurarak sorunların azaltılması ve saldırı tespit sistemlerinin performansını yükseltilmesi amacıyla kullanılmaktadır. Bu çalışmada saldırı tespit sistemlerinin performansını yükseltmek amacıyla belirlediğimiz makine öğrenme yöntemlerini uygulayarak en iyi performansı gösteren J48 algoritması olup %99.92 bir doğruluk oranı elde edilmiştir. Bu algoritma saldırı tespit sistemleri tarafından kullanılması için önerilen algoritma olup STS’nin çeşitli ağ trafiğini ayırt etmesine ve dışarıdan gelen trafiği saldırı olup olmadığına karar vermesinde yardımcı olacaktır.

Anahtar Kelimeler

Ağ Güvenliği, Hizmet Engelleme Saldırısı, Makine Öğrenmesi, Saldırı Tespit Sistemi

Destekleyen Kurum

Yok

Proje Numarası

Yok

Network traffic analysis with machine learning methods

Öz

Intrusion Detection Systems (IDS) are one of the techniques used to notify network administrators of attacks on the network. Although various anomaly detection techniques have been developed, there are challenges and problems in this area, such as high data dimensionality, impact on computational complexity, and computation time. In addition, false alarms by intrusion detection systems are one of the problems in detecting anomaly traffic. Machine learning methods are used to overcome these problems, reduce the issues, and increase the performance of intrusion detection systems. In this study, the decision tree algorithm shows the best performance by applying the machine learning methods we have determined to increase the performance of intrusion detection systems, and it has demonstrated an accuracy rate of 99.92%. This algorithm is recommended for use by intrusion detection systems in our study, and it will help STS distinguish between various network traffic and decide whether the incoming traffic is an attack or not.

Anahtar Kelimeler

Network security, Distributed denial of service attack (DDoS), Intrusion detection system, Machine learning

Proje Numarası

Yok

Kaynakça

• A. Yulianto, P. Sukarno, N.A. Suwastika, Improving adaboost-based intrusion detection system (IDS) performance on CICIDS 2017 dataset, Journal of Physics: Conference Series, 1192(1), 012018, 2019. https://doi.org/10.1088/1742-6596/ 1192/ 1/ 012018.
• A. Yulianto, P. Sukarno, N.A. Suwastika, Improving adaboost-based intrusion detection system (IDS) performance on CICIDS 2017 dataset, Journal of Physics: Conference Series, 1192(1), 012018, 2019. https://doi.org/10.1088/1742-6596/ 1192/ 1/ 012018.
• G. Engelen, V. Rimmer, W. Joosen, Troubleshooting an intrusion detection dataset: the CICIDS2017 case study. IEEE Security and Privacy Workshops (SPW), pp. 7-12, 2021. https://doi.org/10.1109/SPW53761. 2021.00009.
• G. Engelen, V. Rimmer, W. Joosen, Troubleshooting an intrusion detection dataset: the CICIDS2017 case study. IEEE Security and Privacy Workshops (SPW), pp. 7-12, 2021. https://doi.org/10.1109/SPW53761. 2021.00009.
• V. Priyanka and T. G. Kumar, Performance assessment of IDS based on CICIDS-2017 dataset. Information and Communication Technology for Competitive Strategies (ICTCS 2020), pp. 611-621, 2022. https://doi.org/10.1007/978-981-16-0739-4_58.
• V. Priyanka and T. G. Kumar, Performance assessment of IDS based on CICIDS-2017 dataset. Information and Communication Technology for Competitive Strategies (ICTCS 2020), pp. 611-621, 2022. https://doi.org/10.1007/978-981-16-0739-4_58.
• A. Rosay, E. Cheval, F. Carlier and P. Leroux, Network intrusion detection: a comprehensive analysis of CIC-IDS2017. 8th International Conference on Information Systems Security and Privacy, pp. 25-36, 2022. https://doi.org/10.5220/0010774000003120.
• A. Rosay, E. Cheval, F. Carlier and P. Leroux, Network intrusion detection: a comprehensive analysis of CIC-IDS2017. 8th International Conference on Information Systems Security and Privacy, pp. 25-36, 2022. https://doi.org/10.5220/0010774000003120.
• R.R. Boukaert, E. Frank, M. Hall, R. Kirby, P. Reutemann, A. Seewald, D. Scuse, Weka manual for version 3-7-3, The University of Waikato, 327, 2010.
• R.R. Boukaert, E. Frank, M. Hall, R. Kirby, P. Reutemann, A. Seewald, D. Scuse, Weka manual for version 3-7-3, The University of Waikato, 327, 2010.
• S. Singhal and M. Jena, A study on WEKA tool for data preprocessing, Classification and Clustering. International Journal of Innovative Technology and Exploring Engineering (IJItee), 2(6), 250-253, 2013.
• S. Singhal and M. Jena, A study on WEKA tool for data preprocessing, Classification and Clustering. International Journal of Innovative Technology and Exploring Engineering (IJItee), 2(6), 250-253, 2013.
• C. Gürmen, Saldırı tespit sistemleri için makine öğrenme yöntemlerinin performans karşılaştırması. Yüksek Lisans Tezi, Harran Üniversitesi, Türkiye, 2020.
• C. Gürmen, Saldırı tespit sistemleri için makine öğrenme yöntemlerinin performans karşılaştırması. Yüksek Lisans Tezi, Harran Üniversitesi, Türkiye, 2020.
• C. Kruegel and G. Vigna, Anomaly detection of web-based attacks. Proceedings of the 10th ACM Conference on Computer and Communications Security, 251-261, Washington D.C., USA, 2003. https://doi.org/10.1145/948109. 948144.
• C. Kruegel and G. Vigna, Anomaly detection of web-based attacks. Proceedings of the 10th ACM Conference on Computer and Communications Security, 251-261, Washington D.C., USA, 2003. https://doi.org/10.1145/948109. 948144.
• A.A. Abdulrahman and M.K. Ibrahem, Toward constructing a balanced intrusion detection dataset based on CICIDS2017, Samarra Journal of Pure and Applied Science, 2(3), 132-142, 2020.
• A.A. Abdulrahman and M.K. Ibrahem, Toward constructing a balanced intrusion detection dataset based on CICIDS2017, Samarra Journal of Pure and Applied Science, 2(3), 132-142, 2020.
• A.N. Bhagoji, D. Culina, C. Sitawarin, P. Mittal, Enhancing robustness of machine learning systems via data transformations. 52nd Annual Conference on Information Sciences and Systems (CISS), pp. 1-5, 2018. https://doi.org/10.1109/CISS.2018.8362326.
• A.N. Bhagoji, D. Culina, C. Sitawarin, P. Mittal, Enhancing robustness of machine learning systems via data transformations. 52nd Annual Conference on Information Sciences and Systems (CISS), pp. 1-5, 2018. https://doi.org/10.1109/CISS.2018.8362326.
• K.K. Vasan and B. Surendiran, Dimensionality reduction using principal component analysis for network intrusion detection, Perspectives in Science, 8, 510-512, 2016. https://doi.org/10.1016/j.pisc.2016.05. 010.
• K.K. Vasan and B. Surendiran, Dimensionality reduction using principal component analysis for network intrusion detection, Perspectives in Science, 8, 510-512, 2016. https://doi.org/10.1016/j.pisc.2016.05. 010.
• M.I. Jordan and T.M. Mitchell, Machine learning: trends, perspective, and prospects, Science, 349(6245), 255-260 2015. https://doi.org/10.1126/science. aaa8415.
• M.I. Jordan and T.M. Mitchell, Machine learning: trends, perspective, and prospects, Science, 349(6245), 255-260 2015. https://doi.org/10.1126/science. aaa8415.
• M.A. Alsheikh, S. Lin, D. Niyato, H.P. Tan, Machine learning in wireless sensor networks: algorithms, strategies, and applications, IEEE Communications Surveys & Tutorials, 16(4), 1996-2018, 2014. https://doi.org/10.1109/COMST.2014.2320099.
• M.A. Alsheikh, S. Lin, D. Niyato, H.P. Tan, Machine learning in wireless sensor networks: algorithms, strategies, and applications, IEEE Communications Surveys & Tutorials, 16(4), 1996-2018, 2014. https://doi.org/10.1109/COMST.2014.2320099.
• I. Butun, S. D. Morgera, R. Sankar, A survey of intrusion detection systems in wireless sensor networks, IEEE Communications Surveys & Tutorials, 16(1), 266-282, 2013. https://doi.org/10.1109/SURV. 2013.050113.00191
• I. Butun, S. D. Morgera, R. Sankar, A survey of intrusion detection systems in wireless sensor networks, IEEE Communications Surveys & Tutorials, 16(1), 266-282, 2013. https://doi.org/10.1109/SURV. 2013.050113.00191
• K. Rai, M.S. Devi, A. Guleria, Decision tree-based algorithm for intrusion detection, International Journal of Advanced Networking and Applications, 7(4), 2828-2834‏, 2016.
• K. Rai, M.S. Devi, A. Guleria, Decision tree-based algorithm for intrusion detection, International Journal of Advanced Networking and Applications, 7(4), 2828-2834‏, 2016.
• A. L. Buczak, E. Guven, A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications surveys & tutorials, 18(2), 1153-1176, 2015. https://doi.org/10.1109/ COMST.2015.2494502.
• A. L. Buczak, E. Guven, A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications surveys & tutorials, 18(2), 1153-1176, 2015. https://doi.org/10.1109/ COMST.2015.2494502.
• S.M. Tahsien, H. Karimipour, P. Spachos, Machine learning based solutions for security of internet of things (Iot): a survey. Journal of Network and Computer Applications, 161, 102630, 2020. https://doi.org/10.1016/j.jnca.2020.102630.
• S.M. Tahsien, H. Karimipour, P. Spachos, Machine learning based solutions for security of internet of things (Iot): a survey. Journal of Network and Computer Applications, 161, 102630, 2020. https://doi.org/10.1016/j.jnca.2020.102630.
• Y. Xin, L. Kong, Z. Liu, Y. Chen, Y. Li, H. Zhu, M. Gao, H. Hou, C. Wang, Machine learning and deep learning methods for cybersecurity. IEEE Access, 6, 35365-35381, 2018. https://doi.org/10.1109/ACCESS. 2018.2836950.
• Y. Xin, L. Kong, Z. Liu, Y. Chen, Y. Li, H. Zhu, M. Gao, H. Hou, C. Wang, Machine learning and deep learning methods for cybersecurity. IEEE Access, 6, 35365-35381, 2018. https://doi.org/10.1109/ACCESS. 2018.2836950.
• F. Chen, P. Deng, J. Wan, Dd Zhang, A.V. Vasilakos, X. Rong, Data mining for the internet of things: literature review and challenges. International Journal of Distributed Sensor Networks, 431047, 2015. https://doi.org/10.1155/2015/431047.
• F. Chen, P. Deng, J. Wan, Dd Zhang, A.V. Vasilakos, X. Rong, Data mining for the internet of things: literature review and challenges. International Journal of Distributed Sensor Networks, 431047, 2015. https://doi.org/10.1155/2015/431047.
• Z. Deng, X. Zhu, D. Cheng, M. Zong, S. Zhang, Efficient knn classification algorithm for big data. Neurocomputing, 195, 143-148, 2016. https://doi.org/ 10.1016/j.neucom.2015.08.112
• Z. Deng, X. Zhu, D. Cheng, M. Zong, S. Zhang, Efficient knn classification algorithm for big data. Neurocomputing, 195, 143-148, 2016. https://doi.org/ 10.1016/j.neucom.2015.08.112
• A. Aldallal, F. Alisa, Effective intrusion detection dystem to secure data in cloud using machine learning. Symmetry, 13(12), 1-26, 2021. https://doi.org/10.3390/ sym13122306.
• A. Aldallal, F. Alisa, Effective intrusion detection dystem to secure data in cloud using machine learning. Symmetry, 13(12), 1-26, 2021. https://doi.org/10.3390/ sym13122306.
• M. Al-Qatf, Y. Lasheng, M. Al-Habib, K. Al-Sabahi, Deep learning approach combining sparse autoencoder with SVM for network intrusion detection. IEEE Access. 6, 52843-52856, 2018. https://doi.org/10.1109/ ACCESS.2018.2869577.
• M. Al-Qatf, Y. Lasheng, M. Al-Habib, K. Al-Sabahi, Deep learning approach combining sparse autoencoder with SVM for network intrusion detection. IEEE Access. 6, 52843-52856, 2018. https://doi.org/10.1109/ ACCESS.2018.2869577.
• M. Alkasassbeh, M. Almseidin, Machine learning methods for network intrusion detection. arXiv preprint, arXiv:1809.02610, 2018. https://doi.org/ 10.48550/arXiv.1809. 02610.
• M. Alkasassbeh, M. Almseidin, Machine learning methods for network intrusion detection. arXiv preprint, arXiv:1809.02610, 2018. https://doi.org/ 10.48550/arXiv.1809. 02610.