Những mô hình thống kê trong các hệ thống phát hiện xâm nhập

NHỮNG MÔ HÌNH THỐNG KÊ TRONG CÁC HỆ THỐNG PHÁT

HIỆN XÂM NHẬP

SVTH: Đào Văn Quang

GVHD: ThS Vương Thị Nhung

Tó m tắt - Làn só ng của đại dịch COVID-19 đã tạo cơ hội cho cô ng nghệ xâ m nhập ngày càng

sâ u rộng vào mọi lĩnh vực của đời sống. Tuy nhiên, nó cũng đặt ra những thá ch thức lớn về bảo mật

thông tin trước cá c cuộc tấn cô ng mạng tinh vi. Do đó, bài báo này sẽ tập trung vào việc á p dụng cá c

kỹ thuật học má y vào hệ thống phá t hiện xâ m nhập mạng (IDS). Ngoài ra, nghiên cứu sẽ xâ y dựng

một hệ thống IDS đơn giản và thử nghiệm cá c kỹ thuật học máy để đưa ra những đánh giá và so sánh

trên một số tiêu chí ..

Keywords - Hệ thống phá t hiện xâ m nhập (IDS), Những phương pháp máy học

Abstract - The wave of the COVID-19 pandemic has created opportunities for technology to

penetrate deeper and wider into all areas of life. However, it also poses great challenges for

information security against sophisticated cyber-attacks. Therefore, this paper will focus on applying

machine learning techniques to network intrusion detection systems (IDS). In addition, the study will

build a simple IDS system and experiment with these techniques to make assessments and

comparisons on multiple criteria.

Keywords - Intrusion Detection System (IDS), Machine Learning Techniques

I. INTRODUCTION

Recently, many cyber-attacks have taken place and caused grave consequences. On

May 8, 2021, the American company Colonial Pipeline was hacked by hackers who stole a

considerable amount of data up to 100 gigabytes [1]. This made the whole US wobble, and it

is also the reason why fuel prices are at risk of skyrocketing. Before that, the US was also a

victim of the devastating WannaCry ransomware attack in 2017, in which Vietnam was also

affected. That is just one of the countless cyberattacks that the information systems of

companies and corporations are facing. Therefore, information security and, first of all,

network intrusion detection are the focus of research and development of the scientific

community. Traditional ways of detecting network intrusions are mainly based on building

codes, policies or firewalls. These methods achieve maximum intrusion detection efficiency

with known and familiar intrusions. However, real-life attacks and intrusions are

extraordinarily sophisticated and constantly changing. This requires an intrusion detection

system that "learns" from known attacks, thereby accurately predicting unknown intrusions.

"Machine learning" was born as a great solution to the above problem. In this paper, I will

discuss the application of several machine learning methods to network intrusion detection.

283

Another central point in this study is that I will build a simple IDS system based on several

criteria to evaluate and compare algorithms. Therefore, we believe that this report can serve as

a prototype and a potential perspective for large-scale and further future research.

II. BACKGROUND

A. Network Intrusion

In 1999, the term "Network Intrusion" was born with the aim to recap illegal actions,

causing damage to information systems to perform malicious purposes [2]. It includes four

main types: Denial of Service attack (DoS), Probe attack (Probe), Remote to local attack

(R2L), and User to Root attack (U2R).

1. Denial of Service attack (DoS)

Denial of Service is a form of denial-of-service attack. This is a fairly common form of

attack; it makes the target computer unable to handle the tasks in time and leads to overload.

These DOS attacks usually target virtual servers (VPS) or Web Servers of banks, finance or e-

commerce sites. DOS attacks are usually only attacked from a single location. It will start at

one point and have only one IP range. Therefore, it can be detected and prevented.

2. Probe attack (Probe)

For a Probe attack, the hacker scans the network or computer for easy-to-attack

vulnerabilities through which the hacker can obtain unauthorized information about resources,

vulnerabilities, or services of the system. Probe attacks such as Sniffing, Ping Sweep, Ports

Scanning [3]. Sniffer is a form of listening on the network based on the characteristics of TCP

/ IP mechanism, Sniffer ban.

3. User to Root attack (U2R)

U2R is an attacker with the rights of a normal user who tries to gain the highest access

(administrator privileges) to the system illegally [3]. The most common way of this attack is

to cause a buffer overflow.

4. Remote to local attack (R2L)

This is a controlled attack from a remote computer. Initially, an attacker does not have

an account in the system but tries to send packets to a computer in a system over the network.

Then, they exploit security flaws to gain unauthorized access but as a local user [3]. The

common attack of this type is to guess the password through brute-force dictionary, FTP

Write.

284

B. Intrusion Detection System

1. The term of the Intrusion Detection system

IDS is a system that detects signs of intrusion attacks and can initiate actions on other

devices to prevent the attack [4]. Unlike a firewall, IDS do not prevent access but only

monitors the activities on the network to find out the signs of attack and alert the network

administrator. Another difference is that while both are related to network security, the

firewall monitors intrusions from the outside and prevents them from happening, limiting

access between networks to prevent intrusions. Entered but failed to detect an attack from

within the network. Besides, IDS will evaluate suspicious intrusions when it has happened

and emit warnings, and it monitors attacks originating from within a system.

2. Intrusion Detection system classifications

2.1. IDS classification according to surveillance scope

2.1.1. Network-based IDS (NIDS)

A NIDS must be described as standard equipment capable of detecting network

intrusion [5]. The NIDS can also be a software package you install on a dedicated workstation

that is connected to a network or a device that has the software embedded, and the device is

also connected to the network. After such a connection, the NIDS can scan all the traffic

transmitted on that segment of the network; NIDS work in many of the same ways as in an

anti-virus application and must contain sample or signature files to compare with the

transmitted packet.

2.1.2. Host-based IDS (HIDS)

HIDS is an intrusion detection system installed on computers (hosts). What sets HIDS

apart from NIDS is that HIDS can be installed on many different types of machines such as

servers, workstations, or notebooks [6]. This approach helps the organization to be flexible

while the NIDS is not suitable or beyond its capabilities.

2.2 IDS classification according to implementation techniques

2.1. Signature-based IDS

Signature-based IDS detects intrusions based on intrusions of intrusion through network

traffic analysis and system logs. This technique requires maintaining a signature database, and

this database must be updated regularly every time a new intrusion form or technique is

introduced

2.2. Anomaly-based IDS

Intrusion detection by comparing (statistically) current behavior with the normal

285

operation of the system to detect an anomaly that could be a sign of intrusion. For example,

under normal conditions, the traffic on a server's network interface is approximately 25% of

the maximum communication bandwidth. If at any point this traffic suddenly increases to

50% or more, then it can be assumed that the server is under a DoS attack.

III. AN OVERVIEW OF MACHINE LEARNING AND SOME COMMONLY

USED MACHINE LEARNING METHODS TO INTRUSION DETECTION

A. The terms of Machine learning

The concept of machine learning as stated by Arthur Samuel (1959) that Machine

Learning is the discipline that provides computers with the ability to learn without being

explicitly programmed [7]. It is made clearer by a statement by Professor Tom Mitchell

(1997) that Machine Learning is a computer program that is said to learn from experience E

from T tasks and with a measure of P performance. is applied on task T and is measured by

the measure P increased from experience E [8].

B. Application of machine learning methods in intrusion detection

Figure 1. Intrusion detection based on machine learning models

286

1. Decision tree Classifier method

The Decision Tree is a supervised learning model that can be applied to both classification

and regression problems [9]. Constructing a decision tree on the given training data is the

determination of the questions and their order.

Figure 2. A sample problem of Decision tree Classifier method

2. Random Forest method

Random forest is a supervised learning algorithm that can solve both regression and

classification problems. The Random Forest algorithm will build many decision trees using

the Decision Tree algorithm, but each decision tree will be different (with the random

element). The prediction results are then synthesized from the decision trees [10].

B

Figure 3: A sample of Random forest method

287

3. Naive Bayes Classification method

Naive Bayes Classification (NBC) is a classification algorithm based on probability

calculation applying the Bayes theorem that we have learned in the previous post. This

algorithm belongs to the Supervised Learning group [11].

According to Bayes' theorem, we have the formula for calculating the random probability of

the event y knowing x as follows:

4. K-nearest neighbor method

K-nearest neighbor is one of the simplest supervised-learning algorithms (which works

well in some cases) in Machine Learning. When training, this algorithm does not learn

anything from the training data (this is also why this algorithm is classified as lazy learning),

every calculation is done when it needs to predict the outcome of the new data.

IV. EXECUTING MACHINE LEARNING METHODS TO DETECT

NETWORK INTRUSION

1. Dataset

To experiment and evaluate the effectiveness of network attack detection algorithms,

researchers around the world often use the KDD 99 data set (KDD cup 99). The data set is

derived from MIT's Lincoln Lab, developed for the US Department of Defense Advanced

Defense Project's Advanced Defense Projects' (DARPA) network attack detection assessment

program (DARPA) in 1998 [12].

Dataset

name

Attack status

DoS

Normal

status

Total

or

record

Probe

11656

U2R

52

R2L

994

Full NSL- 45926

KDD

67343

125971

Whole

KDD

3883370

41101

52

1126

972780

4898429

Table 1. The distribution of the number of link-state types in the KDD and NSL-KDD dataset

288

2. Data processing

The training process is based on machine learning models, which mainly perform

calculations on matrices. Therefore, the packets, after having selected 42 features (in red with

feature number 42 being the classification label), need to be preprocessed.

V. Evaluation

Figure 4: Experimental results of four machine learning methods with “Full NSL- KDD”

dataset

At a glance, we can see that Random Forest is the machine learning algorithm that

gives the best results. This algorithm has the highest score on three machine learning model

evaluation criteria, respectively accuracy, precision and f-measure. The Decision tree

classifier algorithm recorded the highest score in the recall criterion. However, Naive Bayes is

the least efficient of the four considered algorithms.

Figure 5: Experimental results of four machine learning methods with “Whole KDD” dataset

The results on the standard data set “Whole KDD” are not too different from the

results above. Random Forest and Decision tree Classifier are still the two best machine

learning algorithms. The Random Forest algorithm has the highest score on two machine

learning model evaluation criteria, accuracy and precision, respectively. While the Decision

289

tree Classifier algorithm recorded the highest score on two criteria recall and f-measure.

Naive Bayes is still the least efficient rated algorithm.

Based on the experimental results and the analysis mentioned, the "Random forest"

algorithm is considered to be a more stable and optimal algorithm than the other three

algorithms. All the machine learning algorithms used should perform well when it comes to

detecting DoS attacks with high accuracy scores and low, less volatile standard deviation of

this evaluation method. However, this stability is shattered when using these algorithms in

detecting other types of attacks such as Probe, R2L, and U2R. Evaluation scores of the model

with high volatility and large standard deviation are evidence for the above statement.

In addition, a discrepancy can be seen in the results of the model evaluation methods.

These results were very high using the “Full NSL-KDD” data set but decreased when using

the “Whole KDD” dataset. This is explained by the following main reasons. First, the data set

“Full NSL-KDD” is extracted 10% from the original data set, so it has little train and test data

set. In addition, the "Full NSL-KDD" data set is optimized, eliminating redundant, repetitive,

and jamming records. This helps the model evaluation result to be always high. Second, the

"Whole KDD" data set has a very large number of records (almost 5 million records). In

addition, it also has many duplicate, noisy records. Therefore, the model evaluations when

running on the “Whole KDD” dataset yield lower results are understandable.

VI. CONCLUSION

Network intrusion detection is one of the most critical aspects of today's network

security. It helps to minimize severe damage to the network. The research focuses on solving

the network intrusion detection problem based on the machine learning approach. The

research results are as follows:

Firstly, the research has presented and codified the issues related to network intrusion

detection and some strategies to solve the intrusion detection problem. Traditional methods

such as rule-based detection, or statistical-based systems, have detected known intrusions well

but are less effective at detecting new attacks. This is also the main disadvantage of traditional

methods. A system based on machine learning promises to solve the problem. Therefore, the

thesis focuses on exploiting and researching this approach.

Secondly, the research has presented some basic knowledge about Machine learning,

and some common machine learning methods such as Decision tree Classifier, K-nearest

neighbor, Random Forest, and Naive Bayer which are often used to solve intrusion problems.

Finally, the research has studied, designed, and implemented some of the most typical

machine learning algorithms for intrusion detection problems, including Decision tree

Classifier, Naive Bayes, K-nearest neighbor, and Random Forest.

290

REFERENCES

[1] V., Stracqualursi, G., Sands and A., Saenz. (2021). Cyberattack forces major US

fuel pipeline to shut down. Available on:

https://edition.cnn.com/2021/05/08/politics/colonial-pipeline-cybersecurity-

attack/index.html

[2] Kendall and K. Robert. (1999). A database of computer attacks for the evaluation of

intrusion detection systems. Massachusetts Institute of Technology.

[3] O., Suad, A., Nabeel, B., Fadl and Z, Ammar. (2018). Survey on Intrusion Detection

System Types. 7. 444-462.

[4] D., Hervé. (2009). An Introduction to Intrusion-Detection Systems.

[5] B., Rebecca. (1998). An Introduction to Intrusion Detection & Assessment.

[6] W., Zhen and Z., Dan. (2012). HIDS and NIDS Hybrid Intrusion Detection System

Model Design. Advanced Engineering Forum. VOL.6-7. Pp.991-994.

[7] A.L. Samuel. (1959). Some studies in machine learning using the game of checkers.

IBM J. Res. Develop. 3 (3) 210229.

[8] T. M. Mitchell. (1997). Machine Learning (1st. ed.). McGraw-Hill, Inc., USA.

[9] R., Kajal, D., Mandalika ad G., Ajay. (2016). Decision Tree Based Algorithm for

Intrusion Detection. International Journal of Advanced Networking and Applications. VOL.7.

pp.2828-2834.

[10] K., Saurabh. (2019). Intrusion Detection System using Random Forest.

[11] B., Sharmila and N., Rohini. (2019). Intrusion Detection System using Naive Bayes

algorithm. pp.1-4.

[12] KDD Cup 1999. Available on:

http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html, October 2007.

291