The phenomenal increase in device connectivity is making the signaling and resource-based operational integrity of networks at the node level increasingly prone to distributed denial of service(DDoS)attacks.The curren...The phenomenal increase in device connectivity is making the signaling and resource-based operational integrity of networks at the node level increasingly prone to distributed denial of service(DDoS)attacks.The current growth rate in the number of Internet of Things(IoT)attacks executed at the time of exchanging data over the Internet represents massive security hazards to IoT devices.In this regard,the present study proposes a new hybrid optimization technique that combines the firefly optimization algorithm with global searches for use in attack detection on IoT devices.We preprocessed two datasets,CICIDS and UNSW-NB15,to remove noise and missing values.The next step is to perform feature extraction using principal component analysis(PCA).Next,we utilize a globalized firefly optimization algorithm(GFOA)to identify and select vectors that indicate low-rate attacks.We finally switch to the Naïve Bayes(NB)classifier at the classification stage to compare it with the traditional extreme gradient boosting classifier in this attack-dimension classifying scenario,demonstrating the superiority of GFOA.The study concludes that the method by GFOA scored outstandingly,with accuracy,precision,and recall levels of 89.76%,84.7%,and 90.83%,respectively,and an F-measure of 91.11%against the established method that had an F-measure of 64.35%.展开更多
Anomaly classification based on network traffic features is an important task to monitor and detect network intrusion attacks.Network-based intrusion detection systems(NIDSs)using machine learning(ML)methods are effec...Anomaly classification based on network traffic features is an important task to monitor and detect network intrusion attacks.Network-based intrusion detection systems(NIDSs)using machine learning(ML)methods are effective tools for protecting network infrastructures and services from unpredictable and unseen attacks.Among several ML methods,random forest(RF)is a robust method that can be used in ML-based network intrusion detection solutions.However,the minimum number of instances for each split and the number of trees in the forest are two key parameters of RF that can affect classification accuracy.Therefore,optimal parameter selection is a real problem in RF-based anomaly classification of intrusion detection systems.In this paper,we propose to use the genetic algorithm(GA)for selecting the appropriate values of these two parameters,optimizing the RF classifier and improving the classification accuracy of normal and abnormal network traffics.To validate the proposed GA-based RF model,a number of experiments is conducted on two public datasets and evaluated using a set of performance evaluation measures.In these experiments,the accuracy result is compared with the accuracies of baseline ML classifiers in the recent works.Experimental results reveal that the proposed model can avert the uncertainty in selection the values of RF’s parameters,improving the accuracy of anomaly classification in NIDSs without incurring excessive time.展开更多
Network Intrusion Detection System(IDS)aims to maintain computer network security by detecting several forms of attacks and unauthorized uses of applications which often can not be detected by firewalls.The features s...Network Intrusion Detection System(IDS)aims to maintain computer network security by detecting several forms of attacks and unauthorized uses of applications which often can not be detected by firewalls.The features selection approach plays an important role in constructing effective network IDS.Various bio-inspired metaheuristic algorithms used to reduce features to classify network traffic as abnormal or normal traffic within a shorter duration and showing more accuracy.Therefore,this paper aims to propose a hybrid model for network IDS based on hybridization bio-inspired metaheuristic algorithms to detect the generic attack.The proposed model has two objectives;The first one is to reduce the number of selected features for Network IDS.This objective was met through the hybridization of bioinspired metaheuristic algorithms with each other in a hybrid model.The algorithms used in this paper are particle swarm optimization(PSO),multiverse optimizer(MVO),grey wolf optimizer(GWO),moth-flame optimization(MFO),whale optimization algorithm(WOA),firefly algorithm(FFA),and bat algorithm(BAT).The second objective is to detect the generic attack using machine learning classifiers.This objective was met through employing the support vector machine(SVM),C4.5(J48)decision tree,and random forest(RF)classifiers.UNSW-NB15 dataset used for assessing the effectiveness of the proposed hybrid model.UNSW-NB15 dataset has nine attacks type.The generic attack is the highest among them.Therefore,the proposed model aims to identify generic attacks.My data showed that J48 is the best classifier compared to SVM and RF for the time needed to build the model.In terms of features reduction for the classification,my data show that the MFO-WOA and FFA-GWO models reduce the features to 15 features with close accuracy,sensitivity and F-measure of all features,whereas MVO-BAT model reduces features to 24 features with the same accuracy,sensitivity and F-measure of all features for all classifiers.展开更多
Nowadays,IT systems rely mainly on artificial intelligence(AI)algorithms to process data.AI is generally used to extract knowledge from stored information and,depending on the nature of data,it may be necessary to app...Nowadays,IT systems rely mainly on artificial intelligence(AI)algorithms to process data.AI is generally used to extract knowledge from stored information and,depending on the nature of data,it may be necessary to apply different AI algorithms.In this article,a novel perspective on the use of AI to ensure the cybersecurity through the study of network traffic is presented.This is done through the construction of a two-stage cyberattack classification ensemble model addressing class imbalance following a one-vs-rest(OvR)approach.With the growing trend of cyberattacks,it is essential to implement techniques that ensure legitimate access to information.To address this issue,this work proposes a network traffic classification system for different categories based on several AI techniques.In the first task,binary models are generated to clearly differentiate each type of traffic from the rest.With binary models generated,an ensemble model is developed in two phases,which allows the separation of legitimate and illegitimate traffic(phase 1)while also identifying the type of illegitimate traffic(phase 2).In this way,the proposed system allows a complete multiclass classification of network traffic.The estimation of global performance is done using a modern dataset(UNSW-NB15),evaluated using two approaches and compared with other state-of-art works.Our proposal,based on the construction of a two-step model,reaches an F1 of 0.912 for the first level of binary classification and 0.7754 for the multiclass classification.These results show that the proposed system outperforms other state-of-the-art approaches(+0.75%and+3.54%for binary and multiclass classification,respectively)in terms of F1,as demon-strated through comparison together with other relevant classification metrics.展开更多
文摘The phenomenal increase in device connectivity is making the signaling and resource-based operational integrity of networks at the node level increasingly prone to distributed denial of service(DDoS)attacks.The current growth rate in the number of Internet of Things(IoT)attacks executed at the time of exchanging data over the Internet represents massive security hazards to IoT devices.In this regard,the present study proposes a new hybrid optimization technique that combines the firefly optimization algorithm with global searches for use in attack detection on IoT devices.We preprocessed two datasets,CICIDS and UNSW-NB15,to remove noise and missing values.The next step is to perform feature extraction using principal component analysis(PCA).Next,we utilize a globalized firefly optimization algorithm(GFOA)to identify and select vectors that indicate low-rate attacks.We finally switch to the Naïve Bayes(NB)classifier at the classification stage to compare it with the traditional extreme gradient boosting classifier in this attack-dimension classifying scenario,demonstrating the superiority of GFOA.The study concludes that the method by GFOA scored outstandingly,with accuracy,precision,and recall levels of 89.76%,84.7%,and 90.83%,respectively,and an F-measure of 91.11%against the established method that had an F-measure of 64.35%.
文摘Anomaly classification based on network traffic features is an important task to monitor and detect network intrusion attacks.Network-based intrusion detection systems(NIDSs)using machine learning(ML)methods are effective tools for protecting network infrastructures and services from unpredictable and unseen attacks.Among several ML methods,random forest(RF)is a robust method that can be used in ML-based network intrusion detection solutions.However,the minimum number of instances for each split and the number of trees in the forest are two key parameters of RF that can affect classification accuracy.Therefore,optimal parameter selection is a real problem in RF-based anomaly classification of intrusion detection systems.In this paper,we propose to use the genetic algorithm(GA)for selecting the appropriate values of these two parameters,optimizing the RF classifier and improving the classification accuracy of normal and abnormal network traffics.To validate the proposed GA-based RF model,a number of experiments is conducted on two public datasets and evaluated using a set of performance evaluation measures.In these experiments,the accuracy result is compared with the accuracies of baseline ML classifiers in the recent works.Experimental results reveal that the proposed model can avert the uncertainty in selection the values of RF’s parameters,improving the accuracy of anomaly classification in NIDSs without incurring excessive time.
基金funded by The World Islamic Sciences and Education University。
文摘Network Intrusion Detection System(IDS)aims to maintain computer network security by detecting several forms of attacks and unauthorized uses of applications which often can not be detected by firewalls.The features selection approach plays an important role in constructing effective network IDS.Various bio-inspired metaheuristic algorithms used to reduce features to classify network traffic as abnormal or normal traffic within a shorter duration and showing more accuracy.Therefore,this paper aims to propose a hybrid model for network IDS based on hybridization bio-inspired metaheuristic algorithms to detect the generic attack.The proposed model has two objectives;The first one is to reduce the number of selected features for Network IDS.This objective was met through the hybridization of bioinspired metaheuristic algorithms with each other in a hybrid model.The algorithms used in this paper are particle swarm optimization(PSO),multiverse optimizer(MVO),grey wolf optimizer(GWO),moth-flame optimization(MFO),whale optimization algorithm(WOA),firefly algorithm(FFA),and bat algorithm(BAT).The second objective is to detect the generic attack using machine learning classifiers.This objective was met through employing the support vector machine(SVM),C4.5(J48)decision tree,and random forest(RF)classifiers.UNSW-NB15 dataset used for assessing the effectiveness of the proposed hybrid model.UNSW-NB15 dataset has nine attacks type.The generic attack is the highest among them.Therefore,the proposed model aims to identify generic attacks.My data showed that J48 is the best classifier compared to SVM and RF for the time needed to build the model.In terms of features reduction for the classification,my data show that the MFO-WOA and FFA-GWO models reduce the features to 15 features with close accuracy,sensitivity and F-measure of all features,whereas MVO-BAT model reduces features to 24 features with the same accuracy,sensitivity and F-measure of all features for all classifiers.
基金supported by the Junta de Extremadura (European Regional Development Fund),Consejería de Economía,Ciencia y Agenda Digital,under Project GR21099.
文摘Nowadays,IT systems rely mainly on artificial intelligence(AI)algorithms to process data.AI is generally used to extract knowledge from stored information and,depending on the nature of data,it may be necessary to apply different AI algorithms.In this article,a novel perspective on the use of AI to ensure the cybersecurity through the study of network traffic is presented.This is done through the construction of a two-stage cyberattack classification ensemble model addressing class imbalance following a one-vs-rest(OvR)approach.With the growing trend of cyberattacks,it is essential to implement techniques that ensure legitimate access to information.To address this issue,this work proposes a network traffic classification system for different categories based on several AI techniques.In the first task,binary models are generated to clearly differentiate each type of traffic from the rest.With binary models generated,an ensemble model is developed in two phases,which allows the separation of legitimate and illegitimate traffic(phase 1)while also identifying the type of illegitimate traffic(phase 2).In this way,the proposed system allows a complete multiclass classification of network traffic.The estimation of global performance is done using a modern dataset(UNSW-NB15),evaluated using two approaches and compared with other state-of-art works.Our proposal,based on the construction of a two-step model,reaches an F1 of 0.912 for the first level of binary classification and 0.7754 for the multiclass classification.These results show that the proposed system outperforms other state-of-the-art approaches(+0.75%and+3.54%for binary and multiclass classification,respectively)in terms of F1,as demon-strated through comparison together with other relevant classification metrics.
