These days, identifying malicious networks has been a subject of study for decades, and since the volume of network traffic is increasing day by day, there is a need for a successful intrusion-detection system that can make the identification process easier during attacks. It is felt to take decisions more accurately and in real time and faster processing. The purpose of this research is to detect intrusion into computer networks by combining K-means and XGboost clustering algorithms. The proposed method is performed in two stages. In the first stage, the pre-processing is done by normalizing and digitizing the data set, as well as removing outliers based on two PCA methods and reducing the dimensions of the feature, then using the learner. We use the k-means algorithm to find the optimal number of clusters, and finally we use the Elbow method to find the optimum number of clusters. The second stage consists of classifying malicious and normal network traffic from each other by combining K-means and XG-Boost algorithms on computing platforms. The experiments in this article were done using the NSLKDD data set and its implementation in the knime emulator platform the final evaluation results show the superiority of the error detection rate, and the accuracy and correctness of the proposed algorithm compared to other similar methods.
Research Article
Intrusion Detection System into computer networks by K-means and XGBoost clustering algorithm
https://doi.org/10.21203/rs.3.rs-3340315/v1
This work is licensed under a CC BY 4.0 License
Version 1
posted
You are reading this latest preprint version
Intrusion detection system
attack detection
strong gradient boosting
clustering techniques
machine learning.
In computer systems, especially with the advancement of the Internet and databases, big data is increasingly expanding and is advancing exponentially
data is increasingly expanding and is advancing exponentially. [1] Technology has evolved exponentially in the last few decades. In addition to having advantages, technology also brings security threats. The protection of modern networks and the Internet is done in order to prevent the penetration of hackers and cyber-attacks. To safety, modern networks, various cyber security methods and protection system such as firewalls, authentication techniques, encryption methods and intrusion-detection systems was introduced to monitor network traffic.
Intrusion detection is an important issue in the network, although significant progress has been made in this field, but there are still many opportunities to improve detection methods and prevent network-based attacks.
Because cyber-attacks are becoming more and more dangerous and their detection is becoming more complicated, the process of security types of attacks and recognizing their patterns is a vital step in network security frameworks.
It is considered effective identification of cyber-attacks is considered a fundamental challenge for network users and managers, especially in modern networks that are evolving rapidly with the advancement of technology. Therefore, to improve the accuracy of intrusion detection and defense against more attacks, many advanced and new techniques of machine learning and automatic machine learning and data mining can be used.
In recent years, different artificial intelligence algorithms and methods have been used in the design of IDS, among which several types of fuzzy methods, genetics, artificial intelligence, etc. can be mentioned. Since speed and accuracies are very important in the design IDS, the combination of genetic algorithm and fuzzy logic seems to be a suitable option to solve this problem. The scope of work of genetic algorithm is very wide and every day with the progress of science and technology. The use of this method in optimization and problem solving has been expanded.
Utilizing machine learning, exploitation information theory, mathematical models are built that can be used for inference. [2] Machine learning techniques are suitable in situations where there is no prior knowledge about data patterns, that's why sometimes these methods are also called bottom-up. The important advantage of this method is that there is usually no need for expert people to determine the desired requirements in order to detect intrusion, for this reason they act very quickly and are affordable. Machine learning techniques are generally divided into two categories, supervised and unsupervised.[3] Today's solutions used for intrusion detection have faced the designers of intrusion-detection systems with difficulties in choosing the type of architecture that can have more reliability in detecting intrusions. In fact, intrusion detection is one of the most important issues raised in security fields. For this reason, the need to find the fastest and most accurate solution for penetration detection prompted researchers to conduct extensive research in this regard [4]
Identifying malicious network intrusions has been a subject of study for decades. However, as data scientists can understand, when the scale of a problem increases by an order of magnitude, existing approaches are often no longer effective. [5, 6] The problem is so different that it needs a new solution, and since the volume of network traffic is increasing day by day, the field of intrusion detection is forced to reinvent itself around big data techniques. [7] An intrusion-detection system monitors networks or other systems for malicious or unusual behavior. By completing preventive technologies such as firewalls, strong authentication and privilege [8] Intrusion-detection systems have become an essential part of organizational information technology security management [9]. These systems are usually classified into two categories under the title of abuse-based or anomaly-based systems. [10] Data mining techniques are increasingly used to detect attacks, anomalies or intrusions in a protected network environment. [11]
In this study, the proposed method was considered in the first stage, the pre-processing is done by normalizing and digitizing the data set, as well as removing outliers based on two PCA methods and reducing the dimensions of the feature, then using the learner. We use the k-means algorithm to find the optimal number of clusters, and finally we use the Elbow method to find the optimum number of clusters. The second stage consists of classifying malicious and normal network traffic from each other by combining K-means and XGBoost algorithms on computing platforms. The main structure of the paper is as follows.
Related work
The subject of research [12] is the use of process mining in host-based intrusion-detection systems. In this article, the authors state that many organizations have moved from data-oriented to process-oriented systems and use process-based information systems to improve their efficiency. It includes pre-processing stages, two parallel stages of abnormality diagnosis and abuse diagnosis and combination of results.
In the study [13], a modern system for feature selection and alarm management that has the capability of active execution was simulated. The obtained results compare the fresh system with other alarm management methods and show that this system has the speed, accuracy and efficiency are much higher than other alarm management methods based on clustering. Additionally, according to the obtained results, it can be seen this system is able to actively classify the alarms of intrusion-detection systems is. The innovation of this research is the use of all the existing algorithms in the classification methods that are available in the Veka software and the proposal of five data samples that are extracted from the primary data and give the best answer for different models and algorithms? The author’s state research aimed at determining the status of the thyroid gland in terms of normality, hyperactivity or hypothyroidism using data mining methods. The predictive model for the classification of thyroid disease has been performed after data pre-processing using supervised and unsupervised machine learning methods. This study is of an analytical type and the database. It contains 215 independent records based on five continuous features and collected from the UCI machine learning data reference. [14] The aim of this research is to reduce the error of thyroid disease diagnosis, which the use of data mining methods helps to reduce this error. In addition, in this article, the diagnosis of thyroidal disease is made with the help of different pattern recognition methods. The results show that the fuzzy neural model has the least amount of error and the most accuracy.
The research [15] is aimed at increasing the accuracy of intrusion detection in the Internet of Things by the support vector machine improved by the grasshopper optimization algorithm. In this research, firstly, he collects the data of the intrusion-detection system in the Internet of Things, and after cleaning the data by using the central average statistics, linear normalization of the data is performed and with Fisher's discriminant analysis algorithm, feature selection is performed and five features out of 41 features were selected. Then, the support vector machine was improved using the grasshopper optimization algorithm, and the results were compared and concluded using the bagging classifier and the K-nearest neighbor classifier. The experimental results using simulators and training data show that the above proposed model has a better performance than bagging and k-nearest neighbor classifications in terms of error statistical analysis. Additionally, in terms of accuracy, the comparison with the improved SVM algorithm with gray wolf and particle swarm optimization shows the better accuracy of this method. In addition, due to the use of algorithms without much complexity and low resource consumption and faster speed, it is a suitable method for detecting attacks in IOT.
In the study [16], an IOT intrusion-detection model based on the light gradient amplification machine is proposed. In the first step, one-dimensional convolutional neural network is used to extract features from network traffic to reduce feature dimensions. Then, the light gradient amplification machine is used for classification to detect the type of network traffic. Based on inheriting the advantages of the gradient boosting tree, the light gradient boosting machine is slighter and the building process in the decision tree is faster. Experiments are conducted on TON- IoT and BoT-IoT data sets, which show that the proposed model has a stronger and lighter performance than the comparison models. It can shorten the prediction time by 90.66%. The experimental results on the test platform built with IoT devices such as Raspberry Pi show that the proposed model can perform effective and real-time intrusion detection in IoT devices better.
In the research conducted [17], an intrusion-detection model is presented using the combination of Square-Chi feature selection and multi-class SVM. Many it uses only one algorithm to classify network traffic as normal and abnormal. Due to the large volume of data, this classifier model does not succeed in achieving a high attack detection rate and reducing the false alarm rate. However, in this solution, by reducing the dimensions of the data, they could achieve an optimal set of features without losing information, and then using the multi-class modeling method. They identified and classified different network attacks.
In research [18], researchers have presented an intrusion-detection system based on the integration of cluster centers and closest neighbors, and based on this, they have proposed a feature display method called CANN. In this method, two distances are measured and added. The first distance is calculated based on the distance between each data sample and its cluster center. The second distance is calculated based on the distance between each data sample and its nearest neighbor. In the following, the sum of these distances is used to display each data sample in the KNN algorithm. The results of the implementation and evaluation of this method on the KDD99Cup data set show that this method is more accurate than the simple KNN method.
In the research [19], a new technique is introduced to improve the intrusion-detection process by managing the complexities of big data related to different forms of heterogeneous security data. To achieve the former objective, SVM
Ensemble is integrated with a CGO
Algorithm
The proposed method improves the intrusion classification accuracy and also identifies nine different types of attacks in the UNSW-NB15 data set. The efficiency of It is evaluated using statistical analysis and various performance measures such as precision, recall, F1 score, precision, ROC curve and confusion matrix by comparing it with unusual base models. The proposed method achieves 96.29% accuracy compared to chip-SVM 89.12%, and 6.47% improvement in it is mentioned in terms of accuracy compared to chip-SVM. The higher classification accuracy shows that it shows fewer false positives when handling security events in big data platforms.
Data Set
In this research, KDDTrain, KDDTest and KDDTest, -21 data sets of NSL-KDD data sets were used. The KDDTrain data set as a training data set contains 125,973 samples, which includes 58,630 attack traffic samples and 67,343 normal traffic samples. In this research, KDDTrain, KDDTest and KDDTest, -21 data sets of NSL-KDD data sets were used. [20] The KDDTrain data set as a training data set contains 125,973 samples, which includes 58,630 attack traffic samples and 67,343 normal traffic samples. The KDDTest collection contains 22544 samples and is used for testing, and as a subset of the KDDTest collection, the KDDTest-21 collection contains a total of 11850 samples. Cross-validation is performed on the KDDTrain set in experiments. [20]
|
Input Attribute |
Num |
Input Attribute |
Num |
Input Attribute |
Num |
|---|---|---|---|---|---|
|
srv_diff_host_rate |
31 |
num_root |
16 |
Duration |
1 |
|
dst_host_count |
32 |
num_file_creations |
17 |
Protocol_Type |
2 |
|
dst_host_srv_count |
33 |
num_shells |
18 |
Service |
3 |
|
dst_host_same_srv_rate |
34 |
num_access_files |
19 |
Flag |
4 |
|
dst_host_diff_srv_rate |
35 |
num_outbound_cmds |
20 |
Src_Bytes |
5 |
|
dst_host_same_src_port_rate |
36 |
is_host_login |
21 |
Dst_Bytes |
6 |
|
dst_host_srv_diff_host_rate |
37 |
is_guest_login |
22 |
Land |
7 |
|
dst_host_serror_rate |
38 |
count |
23 |
wrong_fragment |
8 |
|
dst_host_srv_serror_rate |
39 |
srv_count |
24 |
urgent |
9 |
|
dst_host_rerror_rate |
40 |
serror_rate |
25 |
hot |
10 |
|
dst_host_srv_rerror_rate |
41 |
srv_serror_rate |
26 |
num_failed_logins |
11 |
|
rerror_rate |
27 |
logged_in |
12 |
||
|
srv_rerror_rate |
28 |
num_compromise |
13 |
||
|
same_srv_rate |
29 |
root_shell |
14 |
||
|
diff_srv_rate |
30 |
su_attempted |
15 |
Table 2. The number and proportion of attacks or normality in the NSL-KDD collection
Out of the 41 features in Table 1, there are three symbolical features that are not numerical and must be changed numerically to be understood by machine learning algorithms, and the rests are continuous that are it and do not need to be manipulated. Three characteristics with symbolic properties each included different type, which are numbered from a number of 1 to the last type, depending on their position and appearance in each line of the data set. The table below shows these types.
|
The name of the feature |
types |
numbering |
|---|---|---|
|
protocol_type |
icmp, tcp, udp |
1 تا 3 |
|
service |
IRC, X11, Z39_50, aol, auth, bgp, courier, csnet_ns, ctf, daytime, discard, domain, domain_u, echo, eco_i, ecr_i, efs, exec, finger, ftp, ftp_data, gopher, harvest, hostnames, http, http_2784, http_443, http_8001, imap4, iso_tsap, klogin, kshell, ldap, link, login, mtp, name, netbios_dgm, netbios_ns, netbios_ssn, netstat, nnsp, nntp, ntp_u, other, pm_dump, pop_2, pop_3, printer, private, red_i, remote_job, rje, shell, smtp, sql_net, ssh, sunrpc, supdup, systat, telnet, tftp_u, tim_i, time, urh_i, urp_i, uucp, uucp_path, vmnet, whois |
1 تا 70 |
|
Flag |
OTH, REJ, RSTO, RSTOS0, RSTR, S0, S1, S2, S3, SF, SH |
1 تا 11 |
Normalizing the data set
Clustering is widely used as one of the unsupervised machine learning methods in solving the problems of categorizing and classifying observations. This work is done by examining and calculating the distance functions based on the characteristics of the observations, and the points with the lowest amount of distance are placed in a group. [22] An important issue that arises in this regard is the normalization of data in clustering because the features must be scale-free, in the distance, calculation so that the size of the measurement unit of each dimension does not cause the value of the distance function to be skewed towards one feature. There are different methods for normalization that are used in the data preparation stage, including the "minimum-maximum value" normalization method, which is the most famous method in data normalization. It has been used. [23]
The normalization operation must be done before many data mining algorithms such as neural networks, support vector machine, KNN and K-means, so that different dimensions are evaluated fairly by the algorithm, and the effect of one is not greater than the others. Suppose we denote the minimum values of x in the dimension by a minimum (j) Also, introduce the maximum values in dimension j with the symbol max (j), in this case, if we denote this method of calculation with the symbol Z2, we will have the following relationship. It is known that for non-negative data, it valued of Z2 will be equal to one and the minimum will be zero. [24]
(1)
$$Z2=\frac{{X}_{j}-\text{m}\text{i}\text{n}\left(j\right)}{\text{max}\left(j\right)-\text{m}\text{i}\text{n}\left(j\right)}$$
Proposed method
The two-step penetration detection method proposed in this research is shown in Fig. 2. The initial intrusion-detection data set is done in the first stage of processing by removing incorrect data and digitizing and normalizing classification features. The second stage includes the classification of malicious and normal network traffic based on a hybrid model with K-means and XGBoost on distributed computing platforms.
The two-step penetration detection method proposed in this research is shown in Fig. 2. The initial intrusion-detection data set is done in the first stage of processing by removing incorrect data and digitizing and normalizing classification features. The second stage includes the classification of malicious and normal network traffic based on a hybrid model with K-means and XGBoost on distributed computing platforms.
(2)\({d( y}_{1 },{y}_{2 })=\sqrt{{( y}_{11}-{{y}_{21})}^{2}}\) +\(\sqrt{{( y}_{12}-{{y}_{22})}^{2}}\) + … + \(\sqrt{{( y}_{1n}-{{y}_{2n})}^{2}}\)
It has been designed and implemented using the knime simulator software, which is one of the powerful simulation platforms in data mining. This software allows users visually to create data streams, selectively run some or all analysis steps, and display results and models using widgets. And check interactive views. The knime is written in Java's language and based on Eclipse. This powerful tool includes all data mining methods and machine learning algorithms and can be used for intrusion detection, data mining, testing and implementation. Various machine learning algorithms use it.
In this part, as a research innovation, we adjusted the meta-parameters of the proposed model to get the best results. Furthermore, we optimized the feature rate parameter for feature selection, such as the number of cluster's k, which is directly defined as the anomaly parameter m, the learning rate of the XGBoost algorithm, with eta as the anomaly and es_train and es_test, which is with the training data set and the test data set matches. Table 3 lists the meta-parameters collected from the experimental results in the NSK-KDD data set.
|
Parameters |
Settings |
|---|---|
|
K |
8 |
|
InitSteps |
25 |
|
MaxIter |
100 |
|
attribute_rate |
0.01 |
|
M |
25 |
|
num_round |
100 |
|
max_depth |
20 |
|
eta |
0.3 |
|
es_train |
0.5 |
|
es_test |
0.00013 |
Evaluation criteria of the proposed algorithm
Confusion matrix: It is an analysis scale for classification in the form of a matrix, which consists of four elements: TP and TN, which show the correct classification, and FP and FN, which show the wrong classification.
|
The predicted class |
||||
|---|---|---|---|---|
|
the actual class |
YES |
NO |
Sum |
|
|
YES |
TP |
FN |
P |
|
|
NO |
FP |
TN |
N |
|
|
Sum |
\({P}^{,}\) |
\({N}^{,}\) |
P + N |
|
A part of the records that are correctly classified, which is also called the recognition rate and is defined as the following relationship.
(3)
$$\text{A}\text{c}\text{c}\text{u}\text{r}\text{a}\text{c}\text{y}=\frac{\text{T}\text{P}+\text{T}\text{N}}{\text{P}+\text{N}}$$
The output of the proposed K-means-XGboost IDS
Confusion matrix table of the proposed algorithm
In the table below, the confusion matrix is displayed using the proposed algorithm of the intrusion-detection system based on K-means-XGboost, which is calculated using the training data of NSL-KDD.
|
Attacks |
DoS |
Normal |
Probe |
R2L |
U2R |
|---|---|---|---|---|---|
|
Dos |
78139 |
8 |
0 |
0 |
0 |
|
Normal |
1 |
19618 |
3 |
5 |
0 |
|
Probe |
2 |
6 |
805 |
0 |
0 |
|
R2L |
0 |
11 |
0 |
193 |
0 |
|
U2R |
0 |
3 |
0 |
3 |
7 |
At this stage, the training data was implemented in the simulation environment of Knime software and the results of the learning rate of the XGboost algorithm with and without using clustering was measured and analyzed, and the results are shown in the following tables.
|
Real prediction |
True |
False |
|---|---|---|
|
True |
9461 |
3372 |
|
False |
265 |
9445 |
Binary classification results based on the proposed K-means-XGBoost model.
The table and figure show the evaluation criteria and confusion matrix on the test sets, respectively. The results show that the correctness rate of the algorithm is equal to0. 9986%, the accuracy rate of the algorithm is same to 0.9986%, the sensitivity or recall rate of the algorithm is 0.9986, and the error detection rate using the proposed combined method reaches 0.99.22, which indicates a large majority that in those abnormal, activities are fully identifiable. In addition, at the same time, a false alarm rate of 700.14 is seen for abnormal activities. As a result, this shows the very good effect of the proposed K-means-XGBoost method. Additionally, increased IDS availability may be affected by higher DR and lower FAR. [25]
In this part of the research, the proposed K-means-XGBoost model has been compared with other models, and the results are shown in Table 8 − 4. As it is known, its K-means-XGBoost model, despite having a higher false alarm rate, has a taller detection rate and is better than other reported models, compared to the AE-LSTM model [11], respectively 4.28% and 11.22% accuracy and its detection rate. In addition, the proposed model is improved by 0.39% in terms of accuracy compared to the combined K-Means-RF model [12]. The intrusion-detection mechanism in RNN-IDS [13] uses RNN to obtain an accuracy of 82.49%, which is lower than it K-means-XGBoost. Similarly, DST-TL [14]
| Model | Accuracy (%) | DR (%) | FAR (%) |
|---|---|---|---|
| [114]RNN-IDS | 82.49 | 80 | 12 |
| [115]DST-TL | 84.60 | 86 | 14 |
| [116]AE-LSTM | 89 | 88 | 11 |
| [12]K-Means-RF | 92.89 | 98.57 | 14.6 |
| AdaBoost-Kmeans | 99.85 | 99.84 | 14.56 |
| XGBoost | 99.7 | 99.70 | 14.30 |
| AdaBoost | 99.39 | 99.39 | 14.10 |
| K-means–XGBoost | 99.86 | 99.86 | 14.70 |
Identifying malicious network intrusions has been a subject of study for decades. However, as data scientists can understand, when the scale of a problem increases by an order of magnitude, existing approaches are often no longer effective. The problem is so different that it needs a new solution, and since the volume of network traffic is increasing day by day, the field of intrusion detection is forced to reinvent itself around big data techniques. The number of such aforementioned attacks has increased dramatically, leading to data theft as people unknowingly share their information without fear of losing privacy.
A successful IDS may process high-dimensional data to make real-time and fast decisions, and keep the false alarm rate low and the detection rate lofty. Creating reliable and effective IDS due to unbalanced the availability of data sets, high dimensional data and the evolving nature of cyber-attacks make it a challenging task. An IDS monitors networks or other systems for malicious or unusual behavior. With the completion of preventive technologies such as firewalls, strong authentication and privilege, IDS have become an essential part of organizational information technology security management.
Data mining techniques are increasingly used to detect attacks, anomalies or intrusions in a protected network environment. Data mining can be defined as "the process of discovering interesting patterns" in databases that are useful in decision making. Although data mining is considered an important component in the literature of IDS, unfortunately, most of the research articles are dedicated to abuse-based and anomaly-based systems, and the number of articles in the field of online diagnosis or real time research are very limited. Network traffic is also suitable for training due to its relative strength and simple mechanism. There are several hybrid methods for detecting network anomalies, which include adjusting different data preprocessing techniques and changing the performance indicators of that model includes the model
Framework.
Hybrid method are performed on common data sets, but with the thought that new attack strategies and additional data from various sources will exist in the future, there is a critical need for improvement. We consider the improvement of the model for quick classification of different attacks.
By combining several data-mining techniques and gradient amplification techniques, we found an optimal method for that, and at the end. The proposed algorithm was compared with other algorithms with different criteria and in a simulated environment.
And we did the implementation with experimental and training data. The input data of KDDTrain and KDDTest collections are used from the NSL-KDD data set. The KDDTrain set as a training data set contains 125,973 samples, which includes 58,630 attack traffic samples and 67,343 normal traffic samples. The KDDTest collection contains 22544 samples and is used for testing and is a subset of the KDDTest collection.
The evaluations showed that the XGBoost algorithm, when we use the K-means clustering algorithm, correctly predicts the intrusion detection results much better than without clustering. Moreover, the error detection rate, the correctness rate, and the accuracy rate of the algorithm using the proposed combined method reach 99.86%, which indicates a large majority in which abnormal activities can be fully identified. In addition, at the same time, a low false alarm rate is seen for abnormal activities. In summary, it can be said that the proposed method has been successful in terms of repeating the feature selection process due to the optimization of the features and has reduced the amount of intrusion-detection error.
IDS: Intrusion detection system; ML: Machine Learning; DM: Data mining;
XGBoost: Extreme Gradient Boosting; Clustering techniques;
ML: Machine Learning; k-means clustering;
Research findings
The findings obtained in this research based on the tests conducted in the network IDS are summarized as follows.
The proposed method has been successful in improving the accuracy of attack detection according to the training and learning of the IDS as well as feature selection.
The proposed method has been improved by 4.28% and 11.22% in terms of accuracy index and error detection rate compared to the AE-LSTM combined model.
The proposed algorithm has improved the error detection rate by 1.29 compared to the K-means-RF algorithm.
Compared to the Ada boost-Means algorithm, the proposed algorithm has been optimized by 0.01% in terms of correctness rate and 0.02% in terms of error detection rate.
The proposed method is better than RNN-IDS, DST-TL, AE-LSTM, K-means-RF models in terms of accuracy index.
The combined Ada Boost algorithm along with K-means clustering ranked second after the proposed algorithm with a very small difference.
Future work
Future works for the development and improvement of the proposed method along with guaranteeing penetration and error detection speed without compromising accuracy can be assigned the following.
Improving the current model by using a hybrid set, consisting of different types of classifiers.
Using KPCA as a pre-processor to reduce dimensions in feature selection and using the improved NRBF kernel function by embedding mean square values.
Authors’ contributions
FR has contributed for acquisition of data, analysis and interpretation of data, drafting of the manuscript. MJT has served
as advisor in study conception, and for critical revision. MA has critically reviewed the study proposal and for design. All
authors read and approved the final manuscript.
Author details
1Department of Information Technology Management Islamic Azad University Science and Research Branch of Tehran,
Tehran, Iran.
2Department of Information Technology Engineering, Raja University, Qazvin, Iran.
Acknowledgements
None.
Competing interests
The authors declare that they have no competing interests.
Availability of data and materials
The data set used in this paper is from NSL-KDD99
Funding
None.
Publisher’s Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional afflictions.
- Firouzeh Razavi, and M. Jafar Tarokh and Mahmood Alborzi , An intelligent Alzheimer’s disease diagnosis method using unsupervised feature learning: Journal of Big Data (2019).
- Zhao, X., Application of data mining technology in software intrusion detection and information processing. Wireless Communications and Mobile Computing, 2022. 2022.
- Zhu, Y., et al., Application of data mining technology in detecting network intrusion and security maintenance. Journal of Intelligent Systems, 2021. 30(1): p. 664-676.
- Shahjee, D. and N. Ware, Integrated network and security operation center: A systematic analysis. IEEE Access, 2022. 10: p. 27881-27898.
- [5]. Yang, L. and A. Shami, IoT data analytics in dynamic environments: From an automated machine learning perspective. Engineering Applications of Artificial Intelligence, 2022. 116: p. 105366.
- Khalil, R.A., et al., Deep learning in the industrial internetof things: Potentials, challenges, and emerging applications. IEEE Internet of Things Journal, 2021. 8(14): p. 11016-11040.
- Yang, L. and A. Shami. A transfer learning and optimized CNN based intrusion detection system for Internet of Vehicles. in ICC2022-IEEE International Conference on Communications. 2022. IEEE.
- Sangkatsanee, P., N. Wattanapongsakorn, and C. Charnsripinyo, Practical real-time intrusion detection using machine learning approaches. Computer Communications, 2011. 34(18): p. 2227-2235.
- Axelsson, S., The base-rate fallacy and the difficulty of intrusion detection. ACM Transactions on Information and System Security (TISSEC), 2000. 3(3): p. 186-205.
- de Sá, A.G., A.C. Pereira, and G.L. Pappa, A customized classification algorithm for credit card fraud detection. Engineering Applications of Artificial Intelligence, 2018. 72: p. 21-29.
- Lee, W., S.J. Stolfo, and K.W. Mok. A data mining framework for building intrusion detection models. in Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No. 99CB36344). 1999. IEEE.
- [12]. Seyyedjavad Kazemi Tabar, Rehane Taheri Amiri, and Ghorban Khormandian, "Presenting a new method to improve penetration using a combination of random forest algorithm and genetic algorithm," Modern Defense Sciences and Technologies (Non-Defense Sciences and Technologies), Agent vol. 10, no. 3, pp. 287-296, 2018,
- Namjouye Rad, A.A. and M. Dadgarpour, Detection of network penetration by data mining and using machine learning via SVM algorithm. Karafan Quarterly Scientific Journal, 2021. 17(4): p. 13-34.
- Mohsen Rezaei, Nazanin Zahra Jafari, Hossein Ghafarian, Masoud Khosravi Pharmed, Iman Zabah, and Parvaneh Dehghan, "Comparison of the effectiveness of data mining algorithms in the diagnosis of thyroid disease," Pyavard Salamat, vol. 13, no. 5, pp. 345-358, 2018.
- [15]. Sepehr Sharifi, and Solmaz Kayseri, "Designing an anomaly-based intrusion detection system using support vector machine and grasshopper optimization algorithm in Internet of Things," Telecommunication Engineering, vol. 12, no. 46, pp. 42–58.
- [16]. Thaseen, I.S. and C.A. Kumar, Intrusion detection model using fusion of chi-square feature selection and multi class SVM. Journal of King Saud University-Computer and Information Sciences, 2017. 29(4): p. 462-472.
- [17]. Lin, W.-C., S.-W. Ke, and C.-F. Tsai, CANN: An intrusion detection system based on combining cluster centers and nearest neighbors. Knowledge-based systems, 2015. 78: p. 13-21.
- [18]. Ponmalar, A. and V. Dhanakoti, An intrusion detection approach using ensemble support vector machine based chaos game optimization algorithm in big data platform. Applied Soft Computing, 2022. 116: p. 108295.
- Pattawaro, A. and C. Polprasert. Anomaly-based network intrusion detection system through feature selection and hybrid machine learning technique. in 2018 16th International Conference on ICT and Knowledge Engineering (ICT&KE). 2018. IEEE.
- Lv, H., X. Ji, and Y. Ding. A Mixed Intrusion Detection System utilizing K-means and Extreme Gradient Boosting. in Journal of Physics: Conference Series. 2023. IOP Publishing.
- Lv, H., X. Ji, and Y. Ding. A Mixed Intrusion Detection System utilizing K-means and Extreme Gradient Boosting. in Journal of Physics: Conference Series. 2023. IOP Publishing.
- Kibriya, A.M., et al. Multinomial naive bayes for text categorization revisited. in AI 2004: Advances in Artificial Intelligence: 17th Australian Joint Conference on Artificial Intelligence, Cairns, Australia, December 4-6, 2004. Proceedings 17. 2005. Springer.
- Rennie, J.D., et al. Tackling the poor assumptions of naive bayes text classifiers. in Proceedings of the 20th international conference on machine learning (ICML-03). 2003.
- Afshan, N. and R.K. Rout, Machine learning techniques for IoT data analytics. Big Data Analytics for Internet of Things, 2021: p. 89-113.
- Tahsien, S.M., H. Karimipour, and P. Spachos, Machine learning based solutions for security of Internet of Things (IoT): A survey. Journal of Network and Computer.
No competing interests reported.