Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification
Network Intrusion Detection Systems (NIDSs) using pattern matching have a fatal weakness in that they cannot detect new attacks because they only learn existing patterns and use them to detect those attacks. To solve this problem, a machine learning-based NIDS (ML-NIDS) that detects anomalies throug...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9687553/ |
| _version_ | 1818985821141729280 |
|---|---|
| author | Taehoon Kim Wooguil Pak |
| author_facet | Taehoon Kim Wooguil Pak |
| author_sort | Taehoon Kim |
| collection | DOAJ |
| description | Network Intrusion Detection Systems (NIDSs) using pattern matching have a fatal weakness in that they cannot detect new attacks because they only learn existing patterns and use them to detect those attacks. To solve this problem, a machine learning-based NIDS (ML-NIDS) that detects anomalies through ML algorithms by analyzing behaviors of protocols. However, the ML-NIDS learns the characteristics of attack traffic based on training data, so it, too, is inevitably vulnerable to attacks that have not been learned, just like pattern-matching machine learning. Therefore, in this study, by analyzing the characteristics of learning using representative features, we show that network intrusion outside the scope of the learned data in the feature space can bypass the ML-NIDS. To prevent this, designing the active session to be classified early, before it goes outside the detection range of the training dataset of the ML-NIDS, can effectively prevent bypassing the ML-NIDS. Various experiments confirmed that the proposed method can detect intrusion sessions early (before sessions terminate) significantly improving the robustness of the existing ML-NIDS. The proposed approach can provide more robust and more accurate classification with the same classification datasets compared to existing approaches, so we expect it will be used as one of feasible solutions to overcome weakness and limitation of existing ML-NIDSs. |
| first_indexed | 2024-12-20T18:40:59Z |
| format | Article |
| id | doaj.art-abf9d0dba19f48baa00634da04a354ed |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-20T18:40:59Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-abf9d0dba19f48baa00634da04a354ed2022-12-21T19:29:48ZengIEEEIEEE Access2169-35362022-01-0110107541076710.1109/ACCESS.2022.31450029687553Robust Network Intrusion Detection System Based on Machine-Learning With Early ClassificationTaehoon Kim0https://orcid.org/0000-0001-6087-8331Wooguil Pak1https://orcid.org/0000-0002-9551-7373Department of Information and Communication Engineering, Yeungnam University, Gyeongsan, South KoreaDepartment of Information and Communication Engineering, Yeungnam University, Gyeongsan, South KoreaNetwork Intrusion Detection Systems (NIDSs) using pattern matching have a fatal weakness in that they cannot detect new attacks because they only learn existing patterns and use them to detect those attacks. To solve this problem, a machine learning-based NIDS (ML-NIDS) that detects anomalies through ML algorithms by analyzing behaviors of protocols. However, the ML-NIDS learns the characteristics of attack traffic based on training data, so it, too, is inevitably vulnerable to attacks that have not been learned, just like pattern-matching machine learning. Therefore, in this study, by analyzing the characteristics of learning using representative features, we show that network intrusion outside the scope of the learned data in the feature space can bypass the ML-NIDS. To prevent this, designing the active session to be classified early, before it goes outside the detection range of the training dataset of the ML-NIDS, can effectively prevent bypassing the ML-NIDS. Various experiments confirmed that the proposed method can detect intrusion sessions early (before sessions terminate) significantly improving the robustness of the existing ML-NIDS. The proposed approach can provide more robust and more accurate classification with the same classification datasets compared to existing approaches, so we expect it will be used as one of feasible solutions to overcome weakness and limitation of existing ML-NIDSs.https://ieeexplore.ieee.org/document/9687553/Network intrusion detectionearly classificationrobust classificationadversarial attackmachine-learning |
| spellingShingle | Taehoon Kim Wooguil Pak Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification IEEE Access Network intrusion detection early classification robust classification adversarial attack machine-learning |
| title | Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification |
| title_full | Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification |
| title_fullStr | Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification |
| title_full_unstemmed | Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification |
| title_short | Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification |
| title_sort | robust network intrusion detection system based on machine learning with early classification |
| topic | Network intrusion detection early classification robust classification adversarial attack machine-learning |
| url | https://ieeexplore.ieee.org/document/9687553/ |
| work_keys_str_mv | AT taehoonkim robustnetworkintrusiondetectionsystembasedonmachinelearningwithearlyclassification AT wooguilpak robustnetworkintrusiondetectionsystembasedonmachinelearningwithearlyclassification |