UNSW-NB15
Transcript: Ensemble Classifier Design and Performance Evaluation for Intrusion Detection Using UNSW-NB15 Dataset Zeinab Zoghi The University of Toledo Computer Science Research Project for Master of Science in Computer Science Engineering Special Thanks to My Advisor Dr. Gursel Serpen Reference References [1] Kumar, Vikash, Ayan Kumar Das, and Ditipriya Sinha. "UIDS: a unified intrusion detection system for IoT environment." Evolutionary Intelligence (2019): 1-13. [2] Kanimozhi, V., and Prem Jacob. "UNSW-NB15 Dataset Feature Selection and Network Intrusion Detection using Deep Learning." [3] Tama, Bayu Adhi, and Kyung-Hyune Rhee. "An in-depth experimental study of anomaly detection using gradient boosted machine." Neural Computing and Applications 31.4 (2019): 955-965. [4] Raman, MR Gauthama, et al. "An efficient intrusion detection technique based on support vector machine and improved binary gravitational search algorithm." Artificial Intelligence Review (2019): 1-32. [5] Sharma, Jivitesh, et al. "Multi-layer intrusion detection system with ExtraTrees feature selection, extreme learning machine ensemble, and softmax aggregation." EURASIP Journal on Information Security 2019.1 (2019): 15. [6] Papamartzivanos, Dimitrios, Félix Gómez Mármol, and Georgios Kambourakis. "Dendron: Genetic trees driven rule induction for network intrusion detection systems." Future Generation Computer Systems 79 (2018): 558-574. [7] Kumar, Vikash, et al. "An integrated rule based intrusion detection system: analysis on UNSW-NB15 data set and the real time online dataset." Cluster Computing (2019): 1-22. Conclusion Conclusion The UNSW—NB15 has two major issues, namely class imbalance and class overlap, which need to be addressed prior to being employed for model development. Class imbalance and overlap, if not addressed, are likely to hinder the attack detection and identification performance of intrusion detection systems. We designed an ensemble IDS model and proposed two algorithms in order to shrink the number of false negative rate seen in UNSW-NB15 due to the class imbalance and class overlap The combination of the ensemble model and the algorithms outperformed seven models currently proposed in the literature Result and Discussion Results Binary Classification: 790 attack records are misclassified among the entire 45,332 attack records less than 2% of the overall attacks are misclassified as non-attack or Normal (0.017 missed alarm rate) 1022 of 37,000 Normal records are incorrectly classified as attacks (less than 3% false alarm rate) Multiclass Classification: 4.14% of the 28% overall missed alarm rate is the attack classes misclassified as Normal 3% of 4.14% are Shellcode, Fuzzers, and Analysis misclassified as Normal 23.86% missed alarm rate is associated with misclassification among attack classes 19.20% of Analysis, 6.69% of Backdoor, 4.35% of DoS, 3.04% of Exploits, 0.33% of Generic, 0.88% of Reconnaissance, 2.38% of Shellcode, and 4.55% of Worms attack records are confused with Normal records Binary Classification Binary Classification Multiclass Classification Multiclass Classification Comparative Performance Evaluation Comparative Binary Classification: Multiclass Classification: Data Analysis Analysis Data analysis in order to find if there is any data imbalance and data overlap issue Class Distribution Class Distribution Between-Class Imbalance Data Points Within-Class Imbalance Data Points Analyzing both data imbalance and data overlap with 3D scatter plot Class Overlap T-SNE and PCA PCA: mathematical dimensionality reduction method T-SNE (T- distributed Stochastic Neighbor Embedding): probabilistic dimensionality reduction method. Minimize Kullback-Leibler divergence using gradient descent method T-SNE KMeans Intercluster Distance Map displays the distance of a cluster center to other centers in 2-dimensions The clusters are sized by the number of instances that belong to each center K-mean Table Table Between-Class Imbalance Majority Classes: Normal, Exploits, Generic Minority Classes: Analysis, Backdoor, Shellcode, Worms Methods Methods Feature Selection: choose the smallest subset of features to simplify the subsequent analysis and improve the performance of machine learning algorithms Normalization: transform features to be on a similar scale to improves the performance and training stability of the model Classification: the process of assigning a class label to a particular instance Evaluation Metrics: capable to evaluate the performance of the machine learning Feature Selection Sequential Feature Selection (SFS): naive wrapper feature selection algorithm that starts with a null set and then adds one feature as the first step which depicts the highest value for the objective function. Elastic Net: select one feature among the highly correlated features in each iteration Feature Selection Schematic Diagram Schematic Diagram Diagram Data Cleaning Training: Data Transformation Elastic Net SFS Training Balanced Bagging,
Prezi Present
Prezi Video
Prezi Design
