HELAD: A novel network anomaly detection model based on heterogeneous ensemble learning

Computer Networks - Tập 169 - Trang 107049 - 2020
Ying Zhong1, Wenqi Chen1, Zhiliang Wang2,1, Yifan Chen3, Kai Wang4, Yahui Li5, Xia Yin2,5, Xingang Shi2,1, Jiahai Yang2,1, Keqin Li6
1Institute for Network Sciences and Cyberspace at Tsinghua University, Beijing, China
2Beijing National Research Center for Information Science and Technology, China
3Beijing University of Posts and Telecommunications, Beijing, China
4University of Electronic Science and Technology of China, Chengdu, China
5Department of Computer Science and Technology at Tsinghua University, Beijing, China
6Department of Computer Science, State University of New York, New Paltz, USA

Tóm tắt

Từ khóa


Tài liệu tham khảo

Denning, 1987, An intrusion-detection model, IEEE Trans. Softw. Eng., SE-13, 222, 10.1109/TSE.1987.232894

Sommer, 2010, Outside the closed world: on using machine learning for network intrusion detection, IEEE Symposium on Security and Privacy. IEEE Computer Society

Casas, 2010, Optimal volume anomaly detection and isolation in large-scale IP networks using coarse-grained measurements, Comput. Netw., 54, 1750, 10.1016/j.comnet.2010.01.013

Abraham, 2007, Evolutionary design of intrusion detection programs, Int. J. Netw. Secur., 4, 328

Mishra, 2019, A detailed investigation and analysis of using machine learning techniques for intrusion detection, IEEE Communications Surveys & Tutorials, 21, 686, 10.1109/COMST.2018.2847722

J. Carr, Snort: Open source network intrusion prevention, 2007.

Smith, 2018, Shepard interpolation neural networks with k-means: ashallow learning method for time series classification, 2018 International Joint Conference on Neural Networks (IJCNN), 10.1109/IJCNN.2018.8489490

Shao, 2014, Learning deep and wide: a spectral method for learning deep networks, IEEE Trans. Neural Netw. Learn.Syst., 25, 2303, 10.1109/TNNLS.2014.2308519

Jin, 2015, GPU-Accelerated parallel algorithms for linear rankSVM, J. Supercomput., 71, 4141, 10.1007/s11227-015-1509-6

Kijsipongse, 2018, A hybrid GPU cluster and volunteer computing platform for scalable deep learning, J. Supercomput., 74, 3236, 10.1007/s11227-018-2375-9

Aburomman, 2017, A survey of intrusion detection systems based on ensemble and hybrid classifiers, Comput. Secur., 65, 135, 10.1016/j.cose.2016.11.004

Folino, 2016, Ensemble based collaborative and distributed intrusion detection systems: a survey, J. Netw. Comput. Appl., 66, 1, 10.1016/j.jnca.2016.03.011

Lei, 2012, Improved competitive learning neural networks for network intrusion and fraud detection, Neurocomputing, 75, 135, 10.1016/j.neucom.2011.02.021

Aburomman, 2017, A novel weighted support vector machines multiclass classifier based on differential evolution for intrusion detection systems, Inf. Sci., 414, 225, 10.1016/j.ins.2017.06.007

Jing, 2019, Security data collection and data analytics in the internet: A survey, IEEE Communications Surveys & Tutorials, 21, 586, 10.1109/COMST.2018.2863942

Lee, 2001, Information-theoretic measures for anomaly detection, IEEE Symp. Secur. Privacy, 130

Yu, 2012, A nonparametric adaptive CUSUM method and its application in network anomaly detection, Int. J. Adv. Comput.Technol., 4, 280

Krishnamurthy, 2003, Sketch-based change detection: methods, evaluation, and applications

Brutlag, 2000, Aberrant behavior detection in time series for network service monitoring, in Proceedings of Usenix Conference on System Administration, 139

Patcha, 2007, An overview of anomaly detection techniques: existing solutions and latest technological trends, Comput. Netw., 51, 3448, 10.1016/j.comnet.2007.02.001

Nguyen, 2008, A survey of techniques for internet traffic classification using machine learning, IEEE Commun. Surv. Tutor., 10, 56, 10.1109/SURV.2008.080406

Buczak, 2016, A survey of data mining and machine learning methods for cyber security intrusion detection, IEEE Commun. Surv. Tutor., 18, 1153, 10.1109/COMST.2015.2494502

Mahdavinejad, 2017, Machine learning for internet of things data analysis: a survey, Digital Commun. Netw., 4, 161, 10.1016/j.dcan.2017.10.002

2016, Ian goodfellow and yoshua bengio and aaron courville. deep learning, MIT Press

Shone, 2018, A deep learning approach to network intrusion detection, IEEE Trans. Emerging Top.Comput. Intell., 2, 41, 10.1109/TETCI.2017.2772792

Khan, 2019, TSDL: a two-stage deep learning model for efficient network intrusion detection, IEEE Access, 7, 30373, 10.1109/ACCESS.2019.2899721

Mirsky, 2018, Kitsune: an ensemble of autoencoders for online network intrusion detection, Netw. Distrib. Syst. Secur. Symp., 10.14722/ndss.2018.23204

Du, 2017, Deeplog: anomaly detection and diagnosis from system logs through deep learning, 1285

Wang, 2018, HAST-IDS: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection, IEEE Access, 6, 1792, 10.1109/ACCESS.2017.2780250

Jiang, 2018, Deep learning based multi-channel intelligent attack detection for data security, IEEE Transactions on Sustainable Computing, 10.1109/TSUSC.2018.2793284

Aburomman, 2017, A survey of intrusion detection systems based on ensemble and hybrid classifiers, Comput. Secur., 65, 135, 10.1016/j.cose.2016.11.004

Vanerio, 2017, Ensemble-learning approaches for network security and anomaly detection, Proc. Workshop Big Data Anal.Mach. Learn. Data Commun. Netw., 1

Folino, 2016, Ensemble based collaborative and distributed intrusion detection systems: a survey, J. Netw. Comput. Appl., 66, 1, 10.1016/j.jnca.2016.03.011

Malik, 2011, Binary PSO and random forests algorithm for probe attacks detection in a network, 2011 IEEE congress on evolutionary computation (CEC), 662, 10.1109/CEC.2011.5949682

Bukhtoyarov, 2014, Ensemble-distributed approach in classification problem solution for intrusion detection systems, 255

Masarat, 2014, A novel framework, based on fuzzy ensemble of classifiers for intrusion detection systems

Rijn, 2018, The online performance estimation framework: heterogeneous ensemble learning for data streams, Mach. Learn., 149, 10.1007/s10994-017-5686-9

Hinton, 2012, A practical guide to training restricted Boltzmann machines, Momentum, 9, 599

Welling, 2002, A new learning algorithm for mean field Boltzmann machines

Hinton, 2006, Yee whye teh:a fast learning algorithm for deep belief nets, Neural Comput., 1527, 10.1162/neco.2006.18.7.1527

Hinton, 2011, A fast learning algorithm for deep belief nets, Neural Comput., 18, 1527, 10.1162/neco.2006.18.7.1527

Hinton, 1993, Autoencoders, Minimum Description Length and Helmholtz Free Energy, 3

D.E. Rumelhart, G.E. Hinton, R.J. Williams, Learning representations by back-propagating errors, 1986, 399–421.

Gers, 2014, Learning to forget: continualprediction with LSTM, Neural Comput., 2451

Hochreiter, 1997, Long short-term memory, Neural Comput., 1735, 10.1162/neco.1997.9.8.1735

Fontugne, 2010

Fontugne, 2017, Scaling in internet traffic: a 14 year and 3 day longitudinal study, with multiscale analyses and random projections, IEEE/ACM Trans. Netw., 25, 2152, 10.1109/TNET.2017.2675450

Liu, 2008, Isolation forest, 413

Reynolds, 2015, Gaussian mixture models, Encycl. Biometrics, 827, 10.1007/978-1-4899-7488-4_196

Sahu, 2016, A multiclass SVM classification approach for intrusion detection, Int. Conf. Distrib. Comput. Internet Technol., 10.1007/978-3-319-28034-9_23

Yan, 2018, Effective feature extraction via stacked sparse autoencoder to improve intrusion detection system, IEEE Access, 41238, 10.1109/ACCESS.2018.2858277

Fiore, 2013, Network anomaly detection with the restricted boltzmann machine, Neurocomputing, 13, 10.1016/j.neucom.2012.11.050

Papadimitriou, 2003, Adaptive, hands-off stream mining, 29th Int. Conf. Very Large Data Bases

Ippoliti, 2016, Online adaptive anomaly detection for augmented network flows, ACM Trans. Auton. Adapt. Syst., 11, 1, 10.1145/2934686

Viegas, 2019, Bigflow: real-time and reliable anomaly-based intrusion detection for high-speed networks, Future Gener. Comput. Syst., 93, 473, 10.1016/j.future.2018.09.051

Tama, 2019, An in-depth experimental study of anomaly detection using gradient boosted machine, Neural Comput. Appl., 31, 955, 10.1007/s00521-017-3128-z

Tama, 2019, TSE-IDS: a two-stage classifier ensemble for intelligent anomaly-based intrusion detection system, IEEE Access, 7, 94497, 10.1109/ACCESS.2019.2928048

Hang, 2011, An enhanced SYN cookie defence method for TCP DDos attack, JNW, 6, 1206, 10.4304/jnw.6.8.1206-1213

Tashman, 2000, Out-of-sample tests of forecasting accuracy: an analysis and review, Int. J. Forecast., 16, 437, 10.1016/S0169-2070(00)00065-0

Bergmeir, 2012, On the use of cross-validation for time series predictor evaluation, Inf. Sci., 191, 192, 10.1016/j.ins.2011.12.028

Zhou, 2012

Conove, 1999

García, 2010, Advanced nonparametric tests for multiple comparisons in the design of experiments in computational intelligence and data mining: experimental analysis of power, Inf. Sci., 2044, 10.1016/j.ins.2009.12.010