How to Effectively Collect and Process Network Data for Intrusion Detection?
| Autor: | Rafał Kozik, Witold Hołubowicz, Michał Choraś, Marek Pawlicki, Mikołaj Komisarek |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2021 |
| Předmět: |
Computer science
Science QC1-999 General Physics and Astronomy Feature selection 02 engineering and technology Intrusion detection system USable computer.software_genre Astrophysics Article Set (abstract data type) feature selection NetFlow 0202 electrical engineering electronic engineering information engineering data quality Physics Process (computing) 020206 networking & telecommunications QB460-466 Data quality Benchmark (computing) network behavior analysis 020201 artificial intelligence & image processing Data mining computer network intrusion detection |
| Zdroj: | Entropy, Vol 23, Iss 1532, p 1532 (2021) Entropy Volume 23 Issue 11 |
| ISSN: | 1099-4300 |
| Popis: | The number of security breaches in the cyberspace is on the rise. This threat is met with intensive work in the intrusion detection research community. To keep the defensive mechanisms up to date and relevant, realistic network traffic datasets are needed. The use of flow-based data for machine-learning-based network intrusion detection is a promising direction for intrusion detection systems. However, many contemporary benchmark datasets do not contain features that are usable in the wild. The main contribution of this work is to cover the research gap related to identifying and investigating valuable features in the NetFlow schema that allow for effective, machine-learning-based network intrusion detection in the real world. To achieve this goal, several feature selection techniques have been applied on five flow-based network intrusion detection datasets, establishing an informative flow-based feature set. The authors’ experience with the deployment of this kind of system shows that to close the research-to-market gap, and to perform actual real-world application of machine-learning-based intrusion detection, a set of labeled data from the end-user has to be collected. This research aims at establishing the appropriate, minimal amount of data that is sufficient to effectively train machine learning algorithms in intrusion detection. The results show that a set of 10 features and a small amount of data is enough for the final model to perform very well. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|