A New Method for Flow-Based Network Intrusion Detection Using the Inverse Potts Model

Autor(es)

Pontes, Camila F. T. ^[1] ; de Souza, Manuela M. C. ^[1] ; Gondim, Joao J. C. ^[1] ; Bishop, Matt ^[2] ; Marotta, Marcelo Antonio ^[1]

Afiliação do(s) autor(es)

^[1] Univ Brasilia, Comp Sci Dept, BR-70910900 Brasilia, DF - Brazil

^[2] Univ Calif Davis, Comp Sci Dept, Davis, CA 95616 - USA

• Tipo de documento: Artigo Científico
• Fonte: IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT; v. 18, n. 2, p. 1125-1136, JUN 2021.
• Citações Web of Science: 1

Resumo

Network Intrusion Detection Systems (NIDS) play an important role as tools for identifying potential network threats. In the context of ever-increasing traffic volume on computer networks, flow-based NIDS arise as good solutions for real-time traffic classification. In recent years, different flow-based classifiers have been proposed using Machine Learning (ML) algorithms. Nevertheless, classical ML-based classifiers have some limitations. For instance, they require large amounts of labeled data for training, which might be difficult to obtain. Additionally, most ML-based classifiers are not capable of domain adaptation, i.e., after being trained on an specific data distribution, they are not general enough to be applied to other related data distributions. And, finally, many of the models inferred by these algorithms are black boxes, which do not provide explainable results. To overcome these limitations, we propose a new algorithm, called Energy-based Flow Classifier (EFC). This anomaly-based classifier uses inverse statistics to infer a statistical model based on labeled benign examples. We show that EFC is capable of accurately performing binary flow classification and is more adaptable to different data distributions than classical ML-based classifiers. Given the positive results obtained on three different datasets (CIDDS-001, CICIDS17 and CICDDoS19), we consider EFC to be a promising algorithm to perform robust flow-based traffic classification. (AU)

• Processo FAPESP: 20/05152-7 - PROFISSA: internet do futuro programável para arquiteturas e softwares seguros
• Beneficiário: Lisandro Zambenedetti Granville
• Modalidade de apoio: Auxílio à Pesquisa - Temático