Implementation and Analysis of Machine Learning on Cyber Intrusion Detection
Loading...
Files
Date
2018-06-19T09:51:43Z
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
The focus of the project is, implementation of Machine Learning models to detect intrusions in a computer network from unauthorized users, including perhaps insiders. The task of the intrusion detector is to build a predictive model capable of distinguishing between intrusions or normal connections.
A connection is a sequence of packets flowing to and fro, a source IP address to a destination IP address under some well-defined communication protocol. Each connection is labelled as either normal, or as an attack, with exactly one specific attack type. Attacks fall into four main categories:
1. DOS: denial-of-service, e.g. syn flood;
2. R2L: unauthorized access from a remote machine, e.g. guessing password;
3. U2R: illegitimate access to local super user (root) perquisite, e.g., various ``buffer overflow'' attacks;
4. Probing: surveillance, traffic analysis and other probing, e.g., port scanning.
It's important to note that the probability distribution of test data is not from the same as the training data, and it comprises of specific attack types not in the training data, making the task more realistic. The attack types in training dataset and test dataset are total of 24, and additional 14 respectively.
Experts in this field believe that majority of the novel attacks are variants of known attacks and the "signature" of known attacks can be sufficient to catch novel variants. With the following ideas as base for the project, we will experiment with different machine learning approaches. This project sheds light on complexities, peculiarities and potential of using ML Algorithms for Cyber Security Intrusion Detection and the results of these models are deeply analysed with various evaluation strategies, and also via visualisations.
Description
Keywords
PRABHAT KUMAR PRASAD, 1NH14CS089