Advanced search
Start date
Betweenand
Related content
(Reference retrieved automatically from Web of Science through information on FAPESP grant and its corresponding number as mentioned in the publication by the authors.)

A New Method for Flow-Based Network Intrusion Detection Using the Inverse Potts Model

Full text
Author(s):
Pontes, Camila F. T. [1] ; de Souza, Manuela M. C. [1] ; Gondim, Joao J. C. [1] ; Bishop, Matt [2] ; Marotta, Marcelo Antonio [1]
Total Authors: 5
Affiliation:
[1] Univ Brasilia, Comp Sci Dept, BR-70910900 Brasilia, DF - Brazil
[2] Univ Calif Davis, Comp Sci Dept, Davis, CA 95616 - USA
Total Affiliations: 2
Document type: Journal article
Source: IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT; v. 18, n. 2, p. 1125-1136, JUN 2021.
Web of Science Citations: 1
Abstract

Network Intrusion Detection Systems (NIDS) play an important role as tools for identifying potential network threats. In the context of ever-increasing traffic volume on computer networks, flow-based NIDS arise as good solutions for real-time traffic classification. In recent years, different flow-based classifiers have been proposed using Machine Learning (ML) algorithms. Nevertheless, classical ML-based classifiers have some limitations. For instance, they require large amounts of labeled data for training, which might be difficult to obtain. Additionally, most ML-based classifiers are not capable of domain adaptation, i.e., after being trained on an specific data distribution, they are not general enough to be applied to other related data distributions. And, finally, many of the models inferred by these algorithms are black boxes, which do not provide explainable results. To overcome these limitations, we propose a new algorithm, called Energy-based Flow Classifier (EFC). This anomaly-based classifier uses inverse statistics to infer a statistical model based on labeled benign examples. We show that EFC is capable of accurately performing binary flow classification and is more adaptable to different data distributions than classical ML-based classifiers. Given the positive results obtained on three different datasets (CIDDS-001, CICIDS17 and CICDDoS19), we consider EFC to be a promising algorithm to perform robust flow-based traffic classification. (AU)

FAPESP's process: 20/05152-7 - PROFISSA: Programmable Future Internet for Secure Software Architectures
Grantee:Lisandro Zambenedetti Granville
Support Opportunities: Research Projects - Thematic Grants