A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications
The fast development of communication technologies and computer systems brings several challenges from a security point of view. The increasing number of IoT devices as well as other computing devices make network communications more challenging. The number, sophistication, and severity of network-r...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-10-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/13/19/11067 |
| _version_ | 1797576067882418176 |
|---|---|
| author | Merve Ozkan-Okay Refik Samet Ömer Aslan Selahattin Kosunalp Teodor Iliev Ivaylo Stoyanov |
| author_facet | Merve Ozkan-Okay Refik Samet Ömer Aslan Selahattin Kosunalp Teodor Iliev Ivaylo Stoyanov |
| author_sort | Merve Ozkan-Okay |
| collection | DOAJ |
| description | The fast development of communication technologies and computer systems brings several challenges from a security point of view. The increasing number of IoT devices as well as other computing devices make network communications more challenging. The number, sophistication, and severity of network-related attacks are growing rapidly. There are a variety of different attacks including remote-to-user (R2L), user-to-remote (U2R), denial of service (DoS), distributed DDoS, and probing. Firewalls, antivirus scanners, intrusion detection systems (IDSs), and intrusion prevention systems (IPSs) are widely used to prevent and stop cyber-related attacks. Especially, IDPSs are used to stop and prevent intrusions on communication networks. However, traditional IDSs are no longer effective in detecting complicated cyber attacks from normal network traffic. Because of this, new promising techniques, which specifically utilize data mining, machine learning, and deep learning, need to be proposed in order to distinguish intrusions from normal network traffic. To effectively recognize intrusions, the feature generation, feature selection, and learning processes must be performed delicately before the classification stage. In this study, a new feature selection method called FSAP (Feature Selection Approach) is proposed. In addition, a hybrid attack detection model called SABADT (Signature- and Anomaly-Based Attack Detection Technique) is suggested, which utilizes different classification metrics to recognize attacks. The proposed general method FSACM (Feature Selection and Attack Classification Method) is tested on KDD ’99, UNSW-NB15, and CIC-IDS2017 datasets. According to the experiment results, the proposed method outperformed the state-of-the-art methods in the literature in terms of detection, accuracy, and false-alarm rates. |
| first_indexed | 2024-03-10T21:48:13Z |
| format | Article |
| id | doaj.art-01029764a3b647fc9ab928f4c768b1ab |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-10T21:48:13Z |
| publishDate | 2023-10-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-01029764a3b647fc9ab928f4c768b1ab2023-11-19T14:08:12ZengMDPI AGApplied Sciences2076-34172023-10-0113191106710.3390/app131911067A Novel Feature Selection Approach to Classify Intrusion Attacks in Network CommunicationsMerve Ozkan-Okay0Refik Samet1Ömer Aslan2Selahattin Kosunalp3Teodor Iliev4Ivaylo Stoyanov5Department of Computer Engineering, Ankara University, Ankara 06830, TurkeyDepartment of Computer Engineering, Ankara University, Ankara 06830, TurkeyDepartment of Software Engineering, Bandırma Onyedi Eylül University, Bandırma, Balıkesir 10200, TurkeyDepartment of Computer Technologies, Gönen Vocational School, Bandırma Onyedi Eylül University, Bandırma 10200, TurkeyDepartment of Telecommunication, University of Ruse, 7017 Ruse, BulgariaDepartment of Electrical and Power Engineering, University of Ruse, 7017 Ruse, BulgariaThe fast development of communication technologies and computer systems brings several challenges from a security point of view. The increasing number of IoT devices as well as other computing devices make network communications more challenging. The number, sophistication, and severity of network-related attacks are growing rapidly. There are a variety of different attacks including remote-to-user (R2L), user-to-remote (U2R), denial of service (DoS), distributed DDoS, and probing. Firewalls, antivirus scanners, intrusion detection systems (IDSs), and intrusion prevention systems (IPSs) are widely used to prevent and stop cyber-related attacks. Especially, IDPSs are used to stop and prevent intrusions on communication networks. However, traditional IDSs are no longer effective in detecting complicated cyber attacks from normal network traffic. Because of this, new promising techniques, which specifically utilize data mining, machine learning, and deep learning, need to be proposed in order to distinguish intrusions from normal network traffic. To effectively recognize intrusions, the feature generation, feature selection, and learning processes must be performed delicately before the classification stage. In this study, a new feature selection method called FSAP (Feature Selection Approach) is proposed. In addition, a hybrid attack detection model called SABADT (Signature- and Anomaly-Based Attack Detection Technique) is suggested, which utilizes different classification metrics to recognize attacks. The proposed general method FSACM (Feature Selection and Attack Classification Method) is tested on KDD ’99, UNSW-NB15, and CIC-IDS2017 datasets. According to the experiment results, the proposed method outperformed the state-of-the-art methods in the literature in terms of detection, accuracy, and false-alarm rates.https://www.mdpi.com/2076-3417/13/19/11067cyberattacksintrusion detection systemfeature selectionclassificationmachine learning |
| spellingShingle | Merve Ozkan-Okay Refik Samet Ömer Aslan Selahattin Kosunalp Teodor Iliev Ivaylo Stoyanov A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications Applied Sciences cyberattacks intrusion detection system feature selection classification machine learning |
| title | A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications |
| title_full | A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications |
| title_fullStr | A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications |
| title_full_unstemmed | A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications |
| title_short | A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications |
| title_sort | novel feature selection approach to classify intrusion attacks in network communications |
| topic | cyberattacks intrusion detection system feature selection classification machine learning |
| url | https://www.mdpi.com/2076-3417/13/19/11067 |
| work_keys_str_mv | AT merveozkanokay anovelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT refiksamet anovelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT omeraslan anovelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT selahattinkosunalp anovelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT teodoriliev anovelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT ivaylostoyanov anovelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT merveozkanokay novelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT refiksamet novelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT omeraslan novelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT selahattinkosunalp novelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT teodoriliev novelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications AT ivaylostoyanov novelfeatureselectionapproachtoclassifyintrusionattacksinnetworkcommunications |