Network Intrusion Classification Using Machine Learning and Clustered Features

The rapid expansion of network connections has significantly increased network traffic activity, introducing new cybersecurity challenges and heightened vulnerability to cyber attacks. To address these challenges, researchers have leveraged intelligent techniques such as machine learning (ML) to enhance attack detection accuracy in network traffic. However, ML models often face a data imbalance issue in their training sets. This imbalance, typically due to the uneven distribution of attack classes, hampers the classification performance of ML models in network intrusion detection. To mitigate class imbalance, various resampling techniques can be employed. This study evaluates several resampling techniques, including Random Oversampling, SMOTE, ADASYN, Random Undersampling, Tomek Links, and SMOTE-Tomek. Using the UNSW-NB15 dataset, we trained and tested ML models, including Decision Tree, Random Forest, Gradient Boosting, XGBoost, and 1D-CNN algorithms. Our analysis demonstrates that resampling techniques significantly impact the performance of machine learning models. The Tomek Links technique applied to the 1D-CNN model achieved the highest performance, with an accuracy of 75.27%, a precision of 87.58%, and an F1-score of 76.22%. Notably, the best recall score of 67.57% was obtained from the 1D-CNN model without resampling. These findings provide valuable insights for researchers and engineers, aiding in selecting appropriate resampling techniques for developing robust detection models for network traffic attacks.

As the reliance on digital networks grows, the need for robust security measures becomes paramount. It offers a thorough analysis of creating and assessing a Network Intrusion Detection System (NIDS) incorporating various machine learning algorithms. The selected algorithms consist of K Nearest Neighbour, Naïve Bayes, Decision Tree, Support Vector Machine, and Logistic Regression. Moreover, widely recognised ensemble learning models like CatBoost, AdaBoost, Gradient Boost, Random Forest, and Extreme Gradient Boost. The core objective is to improve the efficiency of intrusion detection by evaluating various machine-learning models. Utilizes feature selection techniques based on chi-square to enhance the relevance and effectiveness of the selected features. The evaluation metrics, particularly Matthews’ Correlation Coefficient (MCC) and ROC Curves, are used in assessing the models’ efficacy. They offer valuable insights into the models’ capability to differentiate between normal and malicious network activities. This study aims to advance cybersecurity by comparing classical machine learning and ensemble models for network intrusion detection. Significantly, our results underscore XGBoost’s effectiveness with 0.996 accuracy and 0.993 MCC, in enhancing digital network security.

Intrusion detection is a significant technique for detecting various attacks in Wireless Mesh Networks (WMNs). Intrusion Detection Systems (IDS) powered by machine learning algorithms play a vital role in enhancing security by actively monitoring data traffic in real-time. The performance of attack detection in IDS is reduced by the existence of noisy and unwanted features in the network data. Hence, extracting Informative Features (IF) is essential for enhancing the effectiveness of the IDS. The proposed approach optimally selects IF from the network dataset, which facilitates in accurately detecting intrusions. Existing methods lack in efficient feature selection, leading to higher computational complexity and lower detection performance. This research aims to enhance IDS accuracy by leveraging the eXtreme Gradient Boosting (XGBoost) algorithm to classify the intrusions in the mesh network of smart grid and the optimal feature selection carried out with the help of Golden Eagle Optimization Algorithm (GEOA). This novel hybrid IDS model enhances the attack detection in WMNs. The proposed IDS’s performance is improved by using a feature selection method based on the GEOA, and then obtained results are compared against evolutionary algorithms-based features selection method. The proposed model of IDS using XGBoost algorithm is tested on a smart grid dataset, and its performance is compared with existing literature works.

Network intrusion detection systems (NIDS) are essential for protecting computer networks against cyberattacks. The selection of a nominal set of essential features that may adequately discriminate malicious traffic from normal traffic is indispensable while developing a NIDS. As such, a more reliable and accurate detection result may be realized when intrusion detection is carried out on a dataset based on an inclusive feature representation. This work presents the pre-processing and feature selection workflow as well as its results in the case of the CIC-IDS-2017 dataset, with a focus on two cyber-attacks, namely Denial-of-Service (DoS) and PortScan. The study applied an ensemble feature selection method based on information gain and Random Forest to filter out important features. Recursive Feature Elimination method was then applied to the reduced features to optimize the selected feature subset. The selected feature subset was experimented with using two classification algorithms, namely support vector machine and multi-layer perceptron. In the evaluation process, four widely used performance metrics were considered. The study results demonstrated the efficacy of the proposed ensemble approach to optimize the selected feature subset for detecting PortScan and DoS attacks in network traffic. Experimental results revealed that the support vector machine had a slight advantage in accuracy and could train more quickly. According to the study's evaluation, the NIDS may be able to shorten processing times without sacrificing the ability to detect PortScan and DoS attacks accurately by choosing a narrow subset of informative features. This suggests the approach might be applicable to real-world NIDS scenarios involving these attacks. The study also provides encouraging perspectives on how ensemble feature selection utilizing MLP and SVM can enhance the effectiveness of NIDS. Building on these findings, more research can create NIDS solutions that are even more reliable and efficient for the dynamic field of cybersecurity.

Background: Insulin resistance is a common etiology of metabolic syndrome, but receiver operating characteristic (ROC) curve analysis shows a weak association in Koreans. Using a machine learning (ML) approach, we aimed to generate the best model for predicting insulin resistance in Korean adults aged > 40 of the Ansan/Ansung cohort using a machine learning (ML) approach. Methods: The demographic, anthropometric, biochemical, genetic, nutrient, and lifestyle variables of 8842 participants were included. The polygenetic risk scores (PRS) generated by a genome-wide association study were added to represent the genetic impact of insulin resistance. They were divided randomly into the training (n = 7037) and test (n = 1769) sets. Potentially important features were selected in the highest area under the curve (AUC) of the ROC curve from 99 features using seven different ML algorithms. The AUC target was ≥0.85 for the best prediction of insulin resistance with the lowest number of features. Results: The cutoff of insulin resistance defined with HOMA-IR was 2.31 using logistic regression before conducting ML. XGBoost and logistic regression algorithms generated the highest AUC (0.86) of the prediction models using 99 features, while the random forest algorithm generated a model with 0.82 AUC. These models showed high accuracy and k-fold values (>0.85). The prediction model containing 15 features had the highest AUC of the ROC curve in XGBoost and random forest algorithms. PRS was one of 15 features. The final prediction models for insulin resistance were generated with the same nine features in the XGBoost (AUC = 0.86), random forest (AUC = 0.84), and artificial neural network (AUC = 0.86) algorithms. The model included the fasting serum glucose, ALT, total bilirubin, HDL concentrations, waist circumference, body fat, pulse, season to enroll in the study, and gender. Conclusion: The liver function, regular pulse checking, and seasonal variation in addition to metabolic syndrome components should be considered to predict insulin resistance in Koreans aged over 40 years.

Cyberspace is a concept describing a widespread, interconnected digital technology with numerous users. New standards add more concerns with tremendous information gathered from various network sources, which can be utilized for focused cyber-attacks. Digital attacks in networks are getting more complex and subsequently introducing expanding difficulties in precisely distinguishing network intrusions. Inability to forestall the network intrusions could debase the validity of safety administrations, for example, information privacy, trustworthiness, and accessibility. In this work, we center around developing a Network Intrusion Detection System which is implemented utilizing Machine Learning Techniques. IDS dependent on ML techniques are successful and exact in distinguishing varied networks intrusions. Also, many of the ML-based IDS experience the ill effects of an increment in false-positive rate, leading to lower precision and accuracy. Consequently, we present an exploration of the UNSW-NB15 intrusion detection dataset that will be utilized for preparing the machine learning models. In our tests, we carry out various ML approaches namely, Support Vector Machine (SVM), Logistic Regression (LR), Random Forest Classifier (RF), Decision Tree (DT), Gradient boosted decision trees (GBDT). The results demonstrated that the hyperparameter optimization technique using Grid Search and Random Search methods and evaluation using k-fold cross-validation gives better optimization of model parameters and henceforth brings about better execution.KeywordsCross-validationCyberattackDecision tree (DT)Gradient boosted decision trees (GBDT)Hyperparameter TuningLogistic regression (LR)Network intrusion detection system (IDS)Random forest classifier (RF)Support vector machine (SVM)

Data-driven interpretable ensemble learning methods for the prediction of wind turbine power incorporating SHAP analysis

Recently, machine learning methodologies are playing an important role in detecting network intrusions (or attacks), which further helps the network administrator to take precautionary measures for preventing intrusions. In this project report, the authors propose to use various techniques like support vector machine, logistic regression, random forest, decision tree, and a hybrid model using artificial neural networks and random forest. The new hybrid model for network intrusion detection aims to achieve better precision, recall, accuracy, and F1 score. To reify this, combined artificial neural network and random forest algorithms are used. In the hybrid model, ANN works as a feature extractor and random forest as a classifier. The data is provided to ANN and the ANN generates new features on the basis of given input. The new features are then provided to random forest as an input. The random forest then classifies the data into different classes on the basis of new data. Here, KddCup99 dataset has been used to evaluate the models and accuracy achieved in each model.

Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system

Intrusion detection systems (IDS) are used in analyzing huge data and diagnose anomaly traffic such as DDoS attack; thus, an efficient traffic classification method is necessary for the IDS. The IDS models attempt to decrease false alarm and increase true alarm rates in order to improve the performance accuracy of the system. To resolve this concern, three machine learning algorithms have been tested and evaluated in this research which are decision jungle (DJ), random forest (RF) and support vector machine (SVM). The main objective is to propose a ML-based network intrusion detection system (ML-based NIDS) model that compares the performance of the three algorithms based on their accuracy and precision of anomaly traffics. The knowledge discovery in databases (KDD) methodology and intrusion detection evaluation dataset (CIC-IDS2017) are used in the testing which both are considered as a benchmark in the evaluation of IDS. The average accuracy results of the SVM is 98.18%, RF is 96.76% and DJ is 96.50% in which the highest accuracy is achieved by the SVM. The average precision results of the SVM is 98.74, RF is 97.96 and DJ is 97.82 in which the SVM got a higher average precision compared with the other two algorithms. The average recall results of the SVM is 95.63, RF is 97.62 and DJ is 95.77 in which the RF achieves the highest average of recall than SVM and DJ. In overall, the SVM algorithm is found to be the best algorithm that can be used to detect an intrusion in the system.

Over the years, the vulnerability of the network system has completely revolutionized the security system. Attackers simply exploit these exposures to gain undue access to network resources. It is essential to safeguard network resources with the Intrusion Prevention System (IPS) and Intrusion Detection System (IDS). Hence, to develop an optimized IDS model using ensemble modeling of machine learning technique is paramount. Therefore, this research attempts to build a network IDS using an ensemble of Decision Trees (DT) algorithms to optimize an IDS model. Furthermore, the C4.5 DT classifier used on the University of New South Wales Network-Based 2015 (UNSW-NB15) network data set. Then the ensemble techniques of bagging and AdaBoost are compared during the performance evaluation. The results of this work depict that performance increase as training size increases. Consequently, the results showed that adopting the ensemble model for the C4.5 decision tree classified improved network intrusion classification compared to using the machine learning algorithm in isolation. Moreover, the result also showed an improved classification model for network IDS model. The AdaBoost ensemble model of the C4.5 DT algorithm using partitions of 90% of training and 10% of testing data sets performs the best with 98% accuracy and precision.

Anomaly detection is a critical issue in Network Intrusion Detection Systems (NIDSs). Most anomaly based NIDSs employ supervised algorithms, whose performances highly depend on attack-free training data. However, this kind of training data is difficult to obtain in real world network environment. Moreover, with changing network environment or services, patterns of normal traffic will be changed. This leads to high false positive rate of supervised NIDSs. Unsupervised outlier detection can overcome the drawbacks of supervised anomaly detection. Therefore, we apply one of the efficient data mining algorithms called random forests algorithm in anomaly based NIDSs. Without attack-free training data, random forests algorithm can detect outliers in datasets of network traffic. In this paper, we discuss our framework of anomaly based network intrusion detection. In the framework, patterns of network services are built by random forests algorithm over traffic data. Intrusions are detected by determining outliers related to the built patterns. We present the modification on the outlier detection algorithm of random forests. We also report our experimental results over the KDD'99 dataset. The results show that the proposed approach is comparable to previously reported unsupervised anomaly detection approaches evaluated over the KDD' 99 dataset.

Network Intrusion Detection Systems (NIDS) are critical in ensuring the security of connected computer systems by actively detecting and preventing unauthorized activities and malicious attacks. Machine learning (ML) and deep learning (DL) based NIDS models leverage algorithms that learn from historical network traffic data to identify patterns and anomalies to capture complex relationships. The primary objective of this research is to generate tags and descriptions for the packets that are difficult to classify by the NIDS. Most NIDS datasets that are publicly available have focused on flow data, offering aggregated information about network connections, and have played a crucial role in enabling researchers and network security professionals to design and develop flow-based NIDS solutions. While flow records provide valuable information for detecting network-level anomalies and attacks, they do not consider packet-level information and payload contents. In this research, we propose a packet-level approach for NIDS that leverages the flow information with the packet header fields and payload. To facilitate this research, we have curated a comprehensive Packet-level dataset constructed by extracting the Packet Capture (PCAP) files from two widely used flow-level datasets, namely CIC-IDS2017 and UNSW-NB15. Recent advancements in Natural Language Processing (NLP) have demonstrated the effectiveness of Transformer-based models in handling sequence data with tasks such as token classification and text generation. We have adapted this technology to NIDS to extract key features and characteristics of the header and payload in the context of various attacks. Unlike traditional classification methods that assign predefined labels to network packets, this method focuses on generating tags based on the packet signature that explains the packet content and potential risks. The tags and descriptions offer network security professionals a tool to comprehend suspicious packets with an unfamiliar or potentially malicious signature, assess their nature, and help make informed decisions promptly.

Network intrusion detection systems (NIDSs) is one of the primary components in any network security infrastructure. Currently, many NIDSs that are developed are rule-based systems and their performances mainly depend on the rule sets. But rules formation becomes a tedious and rime consuming task due to the enormous amount of network traffic. This is overcome by using data mining techniques. These techniques build intrusion detection models adaptively. Random forests is an efficient data mining algorithm which can be used for network intrusion detection This can be used for real time intrusion detection. In this paper, we discuss the approaches for feature selection, and optimization of parameters of random forests, compare different models, and also discuss the other method for detecting the anomalies across active networks.

BackgroundPiriform aperture is an anatomical region that has been very little studied in terms of sex estimation. Ensemble learning is similarly an unstudied area in sex estimation from human skeletal remains. In this study, it was aimed to perform sex estimation by using the anthropometric measurements of piriform aperture obtained by computed tomography and 3D reconstruction techniques, discriminant function analysis, machine learning algorithms, and ensemble learning method. A total of 442 cases, 226 male and 216 female, aged between 21 and 89 were included in the study. After sex estimation was performed using discriminant analysis, K-nearest neighbor, Gaussian Naive Bayes, multilayer perceptron neural networks, decision trees, support vector machines, and random forest algorithms, a random forest model that accepted the results of these seven methods as predictors was created, and sex estimation was performed again with ensemble learning.ResultsSex prediction results were obtained with a maximum accuracy of 76.5% with discriminant analysis, 84.2% with machine learning algorithms, and 85.7% with the ensemble learning method.ConclusionsIn conclusion, it was seen that piriform aperture showed moderate sexual dimorphism. Sex estimation results could be further improved with machine learning algorithms and especially with the ensemble learning method.