 ICACT20210214 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Babu Kaji Baniya Department of Computer Science and Digital Technologies Grambling State University Louisiana, USA
I am going to present "Intrusion Representation and Classification using Learning Algorithm" |
| ICACT20210214 Slide.02
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Overview of proposed method
Introduction
Overview of Proposed Method
Discriminant Analysis
Feature Selection (Genetic Algorithm)
Dataset Description
Result and Discussion
Conclusion and Future Work
|
| ICACT20210214 Slide.03
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Introduction
Machine learning algorithms are essential components in designing the sophisticated intrusion detection system (IDS)
They are building-blocks to enhance cyber threat detection and help in classification at host-level and network-level in a short period.
Increasing global connectivity and advancements of network technologies have added unprecedented challenges and opportunities to network security
Malicious attacks impose a huge security threat and warrant scalable solutions to thwart large-scale attacks.
|
| ICACT20210214 Slide.04
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
An IDS is a proactive intrusion detection tool.
It used to detect and classify intrusions and attacks of the security policies automatically at network-level and host-level infrastructure in a periodic manner.
IDS is classified into network-based intrusion detection system (NIDS) and host-based intrusion detection system (HIDS)
Network behaviors are collected using network equipment via mirroring by networking devices:
Switches, routers, and network taps and analyzed in order to identify attacks and possible threats concealed within in network traffic
Characteristics of log files on the user computer in order to detect attacks is called HIDS
|
| ICACT20210214 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
Researchers have already collected a huge amount of datasets (publicly available) for anomaly detection. We implemented the genetic algorithm to find the fitness value and selected the best fitness values from the intrusion population. It ultimately removed the irrelevant and redundant features from the population, and minimized the computational complexity. The best fitness features are presented into 2-dimensional space for further generalization between normal and malicious activities boundary separation.
|
| ICACT20210214 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
Overview of proposed system: Intrusion Detection System |
| ICACT20210214 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
LDA is used to represent how the features are separated into their respective classes. |
| ICACT20210214 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
Feature presentation into 2-dimensional space using LDA |
| ICACT20210214 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
LDA is used to minimize the distance within the class and maximize the distance among the classes. There are five different classes plotted into 2-dimensioanl space. |
| ICACT20210214 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
It is the process of limiting the number of original features dimension by identifying the most discriminative form from the feature pool. The genetic algorithm initializes the population with a random set of features, called chromosomes. Each chromosome is evaluated measuring its ability to predict an output based on the accuracy. The main idea is to replace the initial population with a new one. It includes features from different chromosomes that present a higher classification accuracy
|
| ICACT20210214 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
Selected features using genetic algorithm |
| ICACT20210214 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
The well-known benchmark NSL-KDD dataset used for validation.
This dataset is a refined version of the KDDCup’99 intrusion dataset
It divided two classes i.e., normal and attack
Attack also divided into 4 sub-classes
DoS (Denial of Services Attack)
R2L (Remote to Local Attack)
U2R (User to Root Attack)
Probe
|
| ICACT20210214 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
Dataset Description |
| ICACT20210214 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
NSL-KDD contains 41 different features. It dataset contains 125,973 train sets and 22,544 test set samples.
The features belong to 3 categories
Basic features [1-9],
Content features [10-23] and
Time-based traffic features[24-41]
|
| ICACT20210214 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
The performance of the proposed technique based on selected features using SVM.
|
| ICACT20210214 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
True Positive (TP) - test result is one that detects the risk when the risk is present.
True Negative (TN) - test result is one that does not detect the risk when the risk is absent.
False Positive (FP) - test result is one that detects the risk when the risk is absent.
False Negative (FN) - test result is one that does not detects the risk when the risk is present.
|
| ICACT20210214 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
ROC curve presents the classifier performance of the proposed system. If the cure is closer the upper left corner, it means classier has higher discriminant ability (i.e. higher classification accuracy) |
| ICACT20210214 Slide.18
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Comparison
We compared the the current state of art intrusion detection system and got the best accuracy among the listed results |
| ICACT20210214 Slide.19
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The proposed IDS is designed to achieve optimal accuracy based on minimal information.
It only selected the discriminatory features using GA from the feature pool.
The discriminatory features plotted in 2-dimensional space
Their distribution showed how the different (normal and attack) patterns overlapped and separated each other.
We obtained best accuracies in all stages in both training and testing sets. The classification accuracies of training and testing sets were 97.0% and 93.0% using SVM (in two classes)
|
| ICACT20210214 Slide.20
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Question and Answer |
