Pairwise clusters optimization and cluster most significant feature methods for anomaly-based network intrusion detection system (POC2MSF) / Gervais Hatungimana

Hatungimana, Gervais (2018) Pairwise clusters optimization and cluster most significant feature methods for anomaly-based network intrusion detection system (POC2MSF) / Gervais Hatungimana. Malaysian Journal of Computing (MJoC), 3 (2). pp. 93-107. ISSN 2600-8238

Official URL: https://mjoc.uitm.edu.my

Abstract

Anomaly-based Intrusion Detection System (IDS) uses known baseline to detect patterns which have deviated from normal behaviour. If the baseline is faulty, the IDS performance degrades. Most of researches in IDS which use k-centroids-based clustering methods like K-means, K-medoids, Fuzzy, Hierarchical and agglomerative algorithms to baseline network traffic suffer from high false positive rate compared to signature-based IDS, simply because the nature of these algorithms risk to force some network traffic into wrong profiles depending on K number of clusters needed. In this paper, we propose an alternative method which instead of defining K number of clusters, defines t distance threshold. The unrecognizable IDS; IDS which is neither HIDS nor NIDS is the consequence of using statistical methods for features selection. The speed, memory and accuracy of IDS are affected by inappropriate features reduction method or ignorance of irrelevant features. In this paper, we use two-step features selection and Quality Threshold with Optimization methods to design anomaly-based HIDS and NIDS separately. The performance of our system is 0% ,99.99%, 1,1 false positive rates, accuracy, precision and recall respectively for NIDS and 0%,99.61%, 0.991,0.97 false positive rates, accuracy, precision and recall respectively for HIDS

Metadata

Item Type: Article
Creators:
Creators
Email / ID Num.
Hatungimana, Gervais
unclejeava@yahoo.co.uk
Subjects: Q Science > QA Mathematics > Analysis
Q Science > QA Mathematics > Analysis > Analytical methods used in the solution of physical problems
Q Science > QA Mathematics > Instruments and machines > Electronic Computers. Computer Science > Neural networks (Computer science)
Divisions: Universiti Teknologi MARA, Shah Alam > Faculty of Computer and Mathematical Sciences
Journal or Publication Title: Malaysian Journal of Computing (MJoC)
UiTM Journal Collections: UiTM Journal > Malaysian Journal of Computing (MJoC)
ISSN: 2600-8238
Volume: 3
Number: 2
Page Range: pp. 93-107
Keywords: Clustering, Cluster most significant feature, Network traffic baseline, Network security, Quality threshold
Date: 2018
URI: https://ir.uitm.edu.my/id/eprint/43252
Edit Item
Edit Item

Download

[thumbnail of 43252.pdf] Text
43252.pdf

Download (966kB)

ID Number

43252

Indexing

Statistic

Statistic details