论文标题
基于网络的入侵检测系统中机器学习算法的评估
Evaluation of Machine Learning Algorithms in Network-Based Intrusion Detection System
论文作者
论文摘要
网络安全已成为组织的重点之一。随着互联网使用的不断增长，网络攻击的数量不断增加。入侵检测系统（IDS）是一个警报系统，有助于检测网络攻击。随着新类型的网络攻击继续出现，研究人员专注于开发基于机器学习的ID（ML）以检测零日攻击。研究人员通常会从培训数据集中删除某些或所有攻击样本，并且在评估ID在检测零日攻击时评估ID的性能时，仅将其包含在测试数据集中。尽管此方法可能显示ID检测未知攻击的能力；但是，它不能反映ID的长期性能，因为它仅显示攻击类型的变化。在本文中，我们专注于评估基于ML的ID的长期性能。为了实现这一目标，我们建议使用比培训数据集更晚的数据集评估基于ML的ID。提出的方法可以更好地评估基于ML的ID的长期性能，因为测试数据集反映了攻击类型的变化以及随着时间的推移的网络基础架构的变化。我们已经实施了用于ID的六个最受欢迎的ML模型，包括决策树（DT），随机森林（RF），支持向量机（SVM），幼稚的贝叶斯（NB），人工神经网络（ANN）和深神经网络（DNN）。我们使用CIC-IDS2017和CSE-CIC-IDS2018数据集的实验表明，SVM和ANN对过度拟合性最具抵抗力。除此之外，我们的实验结果还表明，DT和RF在训练数据集中表现良好，但遭受过度拟合度最大。另一方面，我们使用LUFLOD数据集的实验表明，当训练和测试数据集之间的差异很小时，所有模型都可以表现出色。
Cybersecurity has become one of the focuses of organisations. The number of cyberattacks keeps increasing as Internet usage continues to grow. An intrusion detection system (IDS) is an alarm system that helps to detect cyberattacks. As new types of cyberattacks continue to emerge, researchers focus on developing machine learning (ML) based IDS to detect zero-day attacks. Researchers usually remove some or all attack samples from the training dataset and only include them in the testing dataset when evaluating the performance of an IDS on detecting zero-day attacks. Although this method may show the ability of an IDs to detect unknown attacks; however, it does not reflect the long-term performance of the IDS as it only shows the changes in the type of attacks. In this paper, we focus on evaluating the long-term performance of ML based IDS. To achieve this goal, we propose evaluating the ML-based IDS using a dataset that is created later than the training dataset. The proposed method can better assess the long-term performance of an ML-based IDS, as the testing dataset reflects the changes in the type of attack and the changes in network infrastructure over time. We have implemented six of the most popular ML models that are used for IDS, including decision tree (DT), random forest (RF), support vector machine (SVM), naïve Bayes (NB), artificial neural network (ANN) and deep neural network (DNN). Our experiments using the CIC-IDS2017 and the CSE-CIC-IDS2018 datasets show that SVM and ANN are most resistant to overfitting. Besides that, our experiment results also show that DT and RF suffer the most from overfitting, although they perform well on the training dataset. On the other hand, our experiments using the LUFlow dataset have shown that all models can perform well when the difference between the training and testing datasets is small.
