Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network
Intrusion detection and prevention are two of the most important issues to solve in network security infrastructure. Intrusion detection systems (IDSs) protect networks by using patterns to detect malicious traffic. As attackers have tried to dissimulate traffic in order to evade the rules applied,...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-01-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/23/3/1315 |
| _version_ | 1797623269932662784 |
|---|---|
| author | Andrei-Grigore Mari Daniel Zinca Virgil Dobrota |
| author_facet | Andrei-Grigore Mari Daniel Zinca Virgil Dobrota |
| author_sort | Andrei-Grigore Mari |
| collection | DOAJ |
| description | Intrusion detection and prevention are two of the most important issues to solve in network security infrastructure. Intrusion detection systems (IDSs) protect networks by using patterns to detect malicious traffic. As attackers have tried to dissimulate traffic in order to evade the rules applied, several machine learning-based IDSs have been developed. In this study, we focused on one such model involving several algorithms and used the NSL-KDD dataset as a benchmark to train and evaluate its performance. We demonstrate a way to create adversarial instances of network traffic that can be used to evade detection by a machine learning-based IDS. Moreover, this traffic can be used for training in order to improve performance in the case of new attacks. Thus, a generative adversarial network (GAN)—i.e., an architecture based on a deep-learning algorithm capable of creating generative models—was implemented. Furthermore, we tested the IDS performance using the generated adversarial traffic. The results showed that, even in the case of the GAN-generated traffic (which could successfully evade IDS detection), by using the adversarial traffic in the testing process, we could improve the machine learning-based IDS performance. |
| first_indexed | 2024-03-11T09:26:17Z |
| format | Article |
| id | doaj.art-971816fb7dfc400694b778dcb600fb99 |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-03-11T09:26:17Z |
| publishDate | 2023-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-971816fb7dfc400694b778dcb600fb992023-11-16T17:59:17ZengMDPI AGSensors1424-82202023-01-01233131510.3390/s23031315Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial NetworkAndrei-Grigore Mari0Daniel Zinca1Virgil Dobrota2Communications Department, Technical University of Cluj-Napoca, 400114 Cluj-Napoca, RomaniaCommunications Department, Technical University of Cluj-Napoca, 400114 Cluj-Napoca, RomaniaCommunications Department, Technical University of Cluj-Napoca, 400114 Cluj-Napoca, RomaniaIntrusion detection and prevention are two of the most important issues to solve in network security infrastructure. Intrusion detection systems (IDSs) protect networks by using patterns to detect malicious traffic. As attackers have tried to dissimulate traffic in order to evade the rules applied, several machine learning-based IDSs have been developed. In this study, we focused on one such model involving several algorithms and used the NSL-KDD dataset as a benchmark to train and evaluate its performance. We demonstrate a way to create adversarial instances of network traffic that can be used to evade detection by a machine learning-based IDS. Moreover, this traffic can be used for training in order to improve performance in the case of new attacks. Thus, a generative adversarial network (GAN)—i.e., an architecture based on a deep-learning algorithm capable of creating generative models—was implemented. Furthermore, we tested the IDS performance using the generated adversarial traffic. The results showed that, even in the case of the GAN-generated traffic (which could successfully evade IDS detection), by using the adversarial traffic in the testing process, we could improve the machine learning-based IDS performance.https://www.mdpi.com/1424-8220/23/3/1315generative adversarial networkintrusion detection systemintrusion evasionmachine learningNSL-KDD datasetPython |
| spellingShingle | Andrei-Grigore Mari Daniel Zinca Virgil Dobrota Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network Sensors generative adversarial network intrusion detection system intrusion evasion machine learning NSL-KDD dataset Python |
| title | Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network |
| title_full | Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network |
| title_fullStr | Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network |
| title_full_unstemmed | Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network |
| title_short | Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network |
| title_sort | development of a machine learning intrusion detection system and testing of its performance using a generative adversarial network |
| topic | generative adversarial network intrusion detection system intrusion evasion machine learning NSL-KDD dataset Python |
| url | https://www.mdpi.com/1424-8220/23/3/1315 |
| work_keys_str_mv | AT andreigrigoremari developmentofamachinelearningintrusiondetectionsystemandtestingofitsperformanceusingagenerativeadversarialnetwork AT danielzinca developmentofamachinelearningintrusiondetectionsystemandtestingofitsperformanceusingagenerativeadversarialnetwork AT virgildobrota developmentofamachinelearningintrusiondetectionsystemandtestingofitsperformanceusingagenerativeadversarialnetwork |