Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring
Multivariate control charts have been applied in many sectors. One of the sectors that employ this method is network intrusion detection. However, the issue arises when the conventional control chart faces difficulty monitoring the network-traffic data that do not follow a normal distribution as req...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Springer Nature
2023
|
| Subjects: | |
| Online Access: | http://eprints.utm.my/106889/1/MuhammadHisyamLee2023_SupportVectorDataDescriptionwithKernel.pdf |
| _version_ | 1811132431528361984 |
|---|---|
| author | Muhammad Ahsan, Muhammad Ahsan Hidayatul Khusna, Hidayatul Khusna Wibawati, Wibawati Lee, Muhammad Hisyam |
| author_facet | Muhammad Ahsan, Muhammad Ahsan Hidayatul Khusna, Hidayatul Khusna Wibawati, Wibawati Lee, Muhammad Hisyam |
| author_sort | Muhammad Ahsan, Muhammad Ahsan |
| collection | ePrints |
| description | Multivariate control charts have been applied in many sectors. One of the sectors that employ this method is network intrusion detection. However, the issue arises when the conventional control chart faces difficulty monitoring the network-traffic data that do not follow a normal distribution as required. Consequently, more false alarms will be found when inspecting network traffic data. To settle this problem, support vector data description (SVDD) is suggested. The control chart based on the SVDD distance can be applied for the non-normal distribution, even the unknown distributions. Kernel density estimation (KDE) is the nonparametric approach that can be applied in estimating the control limit of the non-parametric control charts. Based on these facts, a multivariate chart based on the integrated SVDD and KDE (SVDD-KDE) is proposed to monitor the network's anomaly. Simulation using the synthetic dataset is performed to examine the performance of the SVDD-KDE chart in detecting multivariate data shifts and outliers. Based on the simulation results, the proposed method produces better performance in detecting shifts and higher accuracy in detecting outliers. Further, the proposed method is applied in the intrusion detection system (IDS) to monitor network attacks. The NSL-KDD data is analyzed as the benchmark dataset. A comparison between the SVDD-KDE chart with the other IDS-based-control chart and the machine learning algorithms is executed. Although the it has high computational cost, the results show that the IDS based on the SVDD-KDE chart produces a high accuracy at 0.917 and AUC at 0.915 with a low false positive rate compared to several algorithms. |
| first_indexed | 2024-09-24T00:04:01Z |
| format | Article |
| id | utm.eprints-106889 |
| institution | Universiti Teknologi Malaysia - ePrints |
| language | English |
| last_indexed | 2024-09-24T00:04:01Z |
| publishDate | 2023 |
| publisher | Springer Nature |
| record_format | dspace |
| spelling | utm.eprints-1068892024-08-01T05:48:04Z http://eprints.utm.my/106889/ Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring Muhammad Ahsan, Muhammad Ahsan Hidayatul Khusna, Hidayatul Khusna Wibawati, Wibawati Lee, Muhammad Hisyam QA Mathematics Multivariate control charts have been applied in many sectors. One of the sectors that employ this method is network intrusion detection. However, the issue arises when the conventional control chart faces difficulty monitoring the network-traffic data that do not follow a normal distribution as required. Consequently, more false alarms will be found when inspecting network traffic data. To settle this problem, support vector data description (SVDD) is suggested. The control chart based on the SVDD distance can be applied for the non-normal distribution, even the unknown distributions. Kernel density estimation (KDE) is the nonparametric approach that can be applied in estimating the control limit of the non-parametric control charts. Based on these facts, a multivariate chart based on the integrated SVDD and KDE (SVDD-KDE) is proposed to monitor the network's anomaly. Simulation using the synthetic dataset is performed to examine the performance of the SVDD-KDE chart in detecting multivariate data shifts and outliers. Based on the simulation results, the proposed method produces better performance in detecting shifts and higher accuracy in detecting outliers. Further, the proposed method is applied in the intrusion detection system (IDS) to monitor network attacks. The NSL-KDD data is analyzed as the benchmark dataset. A comparison between the SVDD-KDE chart with the other IDS-based-control chart and the machine learning algorithms is executed. Although the it has high computational cost, the results show that the IDS based on the SVDD-KDE chart produces a high accuracy at 0.917 and AUC at 0.915 with a low false positive rate compared to several algorithms. Springer Nature 2023-11-06 Article PeerReviewed application/pdf en http://eprints.utm.my/106889/1/MuhammadHisyamLee2023_SupportVectorDataDescriptionwithKernel.pdf Muhammad Ahsan, Muhammad Ahsan and Hidayatul Khusna, Hidayatul Khusna and Wibawati, Wibawati and Lee, Muhammad Hisyam (2023) Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring. Scientific Reports, 13 (1). pp. 1-12. ISSN 2045-2322 http://dx.doi.org/10.1038/s41598-023-46719-3 DOI:10.1038/s41598-023-46719-3 |
| spellingShingle | QA Mathematics Muhammad Ahsan, Muhammad Ahsan Hidayatul Khusna, Hidayatul Khusna Wibawati, Wibawati Lee, Muhammad Hisyam Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring |
| title | Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring |
| title_full | Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring |
| title_fullStr | Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring |
| title_full_unstemmed | Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring |
| title_short | Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring |
| title_sort | support vector data description with kernel density estimation svdd kde control chart for network intrusion monitoring |
| topic | QA Mathematics |
| url | http://eprints.utm.my/106889/1/MuhammadHisyamLee2023_SupportVectorDataDescriptionwithKernel.pdf |
| work_keys_str_mv | AT muhammadahsanmuhammadahsan supportvectordatadescriptionwithkerneldensityestimationsvddkdecontrolchartfornetworkintrusionmonitoring AT hidayatulkhusnahidayatulkhusna supportvectordatadescriptionwithkerneldensityestimationsvddkdecontrolchartfornetworkintrusionmonitoring AT wibawatiwibawati supportvectordatadescriptionwithkerneldensityestimationsvddkdecontrolchartfornetworkintrusionmonitoring AT leemuhammadhisyam supportvectordatadescriptionwithkerneldensityestimationsvddkdecontrolchartfornetworkintrusionmonitoring |