International Journal of Engineering Research in Current Trends (IJERCT)

ISSN: 2582-5488, Volume-1 Issue-1, December 2019

A Survey on Effective Machine Learning

Algorithm for Intrusion Detection System
Anita Verma Dr. Aumreesh Kumar Saxena M. Arsad
M.Tech Schollers CSE SIRTS, Bhopal CSE Dept SIRT, Bhopal CSE Dept SIRT, Bhopal

Abstract— Computer networks security plays an important role because of the quality of network, it's the most effective call
in modern computer systems. In order to enforce high protection to prefer AN NIDS to stay track of adjusting network
levels against threats, a number of software tools are currently atmosphere [2]. That brings to a conclusion as just one ID in
developed. Intrusion Detection Systems (IDS) aims to detect any network will compromise of Confidential or Sensitive
intruder or anomaly in the computer networks. Software model
protects a computer networks from unauthorized users through
knowledge. It might build difficulties to method the massive
detecting intruders in the network. In this we build a machine quantity of traffic owing to just one entry point of a network
learning classifier and trained the model on the NSL-KDD turnout additional specifically after we use DPI (Deep
dataset, after training the model are able to detect or classify the packet Inspection) that works for matching the pattern
attacks in to category like normal or attack. Recently there is against signature packet rules [2]. There square measure
already work done by data mining techniques to accurately detect massive sorts of machine learning algorithms are wide wont
the malicious activities. So to further improve the accuracy of to discover the Anomaly Detection NIDS. for instance,
this intrusion detection system we proposed a deep learning Artificial Neural Network (ANN), SVM (Support Vector
machine. Machine), Random Forest, Self Organized, Naive-Bayesian,
and Deep learning. There has been a sequent development
Keywords— Network security, Intrusion Detection system, data of Network Intrusion Detection System as classifiers to
mining algorithm, machine learning techniques, Anomaly
detection, SVM, Ensemble Learning.
differentiate any anomaly from traditional traffic.
A. Intrusion Detection System
I. INTRODUCTION Intrusion Detection System or IDS is software, hardware or
With the advancement in the technology, millions of people combination of both used to detect intruder activity. Snort is
are now connected with each other through one or other an open source IDS available to the general public. IDS may
form of network where they share lots of important data. have different capabilities depending upon how complex
Hence the need of security to safeguard data integrity and and sophisticated the components are. IDS appliances that
confidentiality is increased rapidly. Although effort have are a combination of hardware and software are available
been made to secure data transmission but at the same time, from many companies. As mentioned earlier, IDS may use
attack technique for breaching the network continued to signatures, anomaly-based techniques or both [3].
evolve. Thus it leads to the need of such a system which can
adapt with these ever changing attack techniques. Attacks
will be varied during a long vary like Brute Force Attack,
Heartbleed Attack, DoS Attack, DDoS Attack, net Attack
etc. The information measure of the network is increasing
apace because the variety of users of the web square
measure increasing. There‘s a large variation of normal Figure 1.1 Intrusion detection System [1]
speed these days that is from 1Gbps to 10Gbps for a mean
knowledge center. The transfer speed and transfer speed is Signature is the pattern that you look for inside a data
completely different for large school. Firms like Google, packet. A signature is used to detect one or multiple types of
Facebook etc., or huge company firms that are from forty attacks. For example, the presence of ―scripts/iisadmin‖ in a
Gbps to 100Gbps [1-2]. Network-based Intrusion Detection packet going to your web server may indicate an intruder
System may be a security tool that protects from an enclosed activity. Signatures may be present in different parts of a
attack, outside attack and unauthorized access into the data packet depending upon the nature of the attack [4]. For
network [2].That is intended by package and/or hardware. example, you can find signatures in the IP header, transport
The foremost acquainted idea is firewall that is made to layer header (TCP or UDP header) and/or application layer
shield the complete network from unauthorized access by header or payload.
information processing address and port variety and
managing these activities by NIDS. it's intensive and wide- B. Data Mining Algorithms for Intrusion Detection
range operating applications which incorporates The growth of data mining methods has consequently
distinguishing the quantity of intrusion makes an attempt on brought forth a wide range of algorithms drawn from areas
the network for instance, denial of service attack hacking as pattern recognition, machine learning and database
activities which can compromise the safety of any single pc analysis.
or whole network by observation the traffic NIDS is mostly There are many types of algorithms that may be used to
placed outside the firewall wherever the complete external
traffic will be monitored by sensing and police investigation
the anomaly activities [2]. Once during an advanced
network, for instance, a tool connected to a thousand nodes,

1
 A Survey on Effective Machine Learning Algorithm for Intrusion Detection System

mine audit data. Data algorithms a set of heuristics designs projected Associate in Nursing AI primarily based Intrusion
between data mining models. These results of analysis are detection system employing a deep neural network. Neural
later used by the algorithm for defining optimal parameters networks consisting of 4 hidden layers and a hundred hidden
to create the selected mining model. The parameters are units were used for the intrusion detection system. They
applied across the dataset, together with selected patterns used non-linear Rely because the activation operates for the
and detailed statistics [5]. Numerous studies indicate that hidden layer neurons to reinforce the model‘s performance.
classification techniques and clustering are by far the most They adopt random improvement technique for learning in
widely used data mining techniques. The hybrid technique is DNN. For the coaching and testing of their model they used
considered shortly after together with the Association KDD CUP ninety nine dataset. They were able to reach the
technique [5] accuracy of ninety nine for all the cases. They need
projected a NIDS (Network Intrusion Detection System) that
C. Machine Learning Aspects
relies on a feature choice technique referred to as
Machine learning could be a technique that has to give an algorithmic Feature Addition (RFA) and written word
enormous quantity of knowledge for coaching the model technique. They tested the model on the ISCX 2012
wherever to predict the long run aspects. Once the model information set. Moreover, they need projected a written
learns from the info absolutely, there's a high chance to word technique to encrypt payload string options into a
predict the long run properly [6]. Machine learning helpful illustration that may be employed in feature choice.
techniques square measure commonly used once any they need additionally projected a replacement analysis
downside cannot be solved by any mathematical calculation metric referred to as that mixes accuracy, detection rate and
or writing any script alone. There are 2 classes of machine warning rate during a method that helps in comparison
learning issues which will be self-addressed. One is completely different systems and choosing the simplest
supervised learning and alternative is unsupervised learning among them.
[7]. In [13] They have planned a replacement intrusion detection
Supervised Learning: In supervised learning, predefined system and self-addressed the matter of ability within the
dataset has been provided before coaching the algorithms. field of intrusion detection. The planned IDS is associate
Firstly, these datasets area unit labelled and supported the degree adaptation answer that provides the potential of
labels or tags, the algorithms learn. Once learning from the detection famed and novel attacks further being updated in
dataset, model will predict any future expectations [8]. step with the new input from human consultants in an
Unsupervised Learning: We propose unattended NIDS with exceedingly cost-efficient manner. It deals with the analysis
reinforcement learning algorithmic program that is and applied math analysis of tagged flow primarily based
compatible with the noted attack still as AN unknown attack CIDDS-001 dataset used for evaluating Anomaly based
[9].That we have a tendency to decision zero-day attack. As (NIDS) Network Intrusion Detection Systems. They
a result of supported the Deep Q Learning algorithmic essentially used 2 techniques; k-means clump and k-nearest
program, that doesn‘t want any past expertise, sees each neighbor classification to live the complexness in terms of
attack, i.e., noted attack or unknown attack as a brand new outstanding metrics. supported analysis, they ended that
attack. Our planned Model‘s initial half has the potential to each k-means clump k-nearest neighbor classification
discover numerous kinds of new attacks, as an example, perform spill CIDDS-001 dataset in terms of used
DoS, DDoS, Heartbleed, port scanning or the other kinds of outstanding metrics. Thence the dataset are often used for
attack which can cause an enormous quantity of network the analysis of Anomaly based mostly Network Intrusion
traffic [10]. At intervals that point, pattern or behaviour of Detection Systems.
network traffic has been analysed by the persona non grata As per [14] The IDS is predicated on anomaly detection
who can cause AN attack. Supported previous analysis on technique. In such technique, a system tries to estimate the
this, NIDS wants longer to visualize the traffic to convey ‗normal‘ state of the network associate degreed generates an
correct call. In this paper, we have analyses of existing IDS alert once any activities deviate from this ‗normal‘ state.
system which is based on various mechanisms. Our aim is to The most advantage of anomaly-based system is that it's
find the issues in existing IDS which cannot predict the type ready to discover antecedently unseen intrusion events.
of network attack and having lowest accuracy. They need classified detection techniques into 3 classes
applied mathematics primarily based, knowledge-based, and
II. LITERATURE REVIEW machine learning-based. In applied mathematics primarily
based technique, a random viewpoint is employed to
2.1. Literature Survey
represent the behavior of the system. Whereas information
According [11] IDS classified the intrusion detection system primarily based technique, utilize the offered system
into 2 sorts particularly Network primarily based IDS and knowledge to capture the behavior of system. Finally, the
Host IDS. The latter monitors all the activities of inspected machine learning primarily based technique uses a certain or
packets and resources that are being utilized by the implicit model to modify categorization of the analyzed
programs. Just in case of any alteration in networks, user pattern. Various machine-learning techniques may result in
gets a network alert. HIDS is incorporated into the pc higher detection rates, lower warning rates, affordable
framework to sight the abnormalities and shield the computation, and communication prices in intrusion
knowledge from the trespasser. On the opposite hand, NIDS detection. During [15], Mahdi Zamani and Mahnush
is that the attribute perform of target system. It uses anti- Movahedi studied many such technique and schemes to
thread software package to manage incoming and outgoing match all their performance. They divide the schemes into
threads. It consists of signature-based classification, that strategies supported classical procedure intelligence (CI)
facilitate in distinctive the abnormalities by comparison it and AI (AI). They make a case for however many options of
with log files and former signature. The authors of [12] CI techniques may be wont to build trendy and economical

2
 International Journal of Engineering Research in Current Trends (IJERCT)
ISSN: 2582-5488, Volume-1 Issue-1, December 2019

IDS. Firstly, network attacks square measure known and attacks. The spatial property reduction is first of all
also the performance of the algorithms square measure performed on forty one attributes to fourteen and seven
compared. The Dimension Reduction focuses on attributes supported Best initial Search technique so two-
victimization info obtained KDD Cup ninety nine classification algorithmic program square measure applied.
knowledge set for the choice of attributes to spot the kind of

Author Objective Tool Algorithm Accuracy Result

Used Used

[11] Gives review on - - - They provide various techniques which

the Data Fusion is applied or helpful in intrusion
for network IDS. detection.

[12] Port Scan - Deep 97.80% Results show that the deep learning
detection trying Learning and algorithm performed significantly better
the Analysis of and SVM 69.79% results than SVM
Deep Learning
and machine Precision
learning
99% and
algorithms
80%

IDS using various Weka AODE 97.19% Result prove that accuracy, DR and
[13] data mining tool algorithm MCC for four types of attacks are
techniques Detection increased by the proposed method.
rate 98%

[14] Intrusion Python Decision 98.04% it is said that Decision Tree model takes
Detection In tree Precision less time for training because it creates
Computer 68% a tree to handle attributes for prediction
Networks By outcomes and affects the final
using Decision Recall classification results
Tree Algorithm 61%

Is based on Weka Random 99.7666, They use Semi-supervised algorithm for

[15] predicting attacks tool tree, J48 99.7785 classifying the attack into two labels
into two labels and Naïve and normal and attack.
using ML Bayes 90.4384
algorithms.

We believe that this ―success discrepancy‖ arises because

III. PROBLEM DEFINITION
the intrusion detection domain exhibits particular
Computer networks are widely used by industry, business characteristics that make the effective deployment of
and various fields of the human life. Therefore, building machine learning approaches fundamentally harder than in
reliable networks is a very important task for IT many other contexts. In the following we identify these
administrators. On the other hand, the rapid development of differences, with an aim of raising the community‘s
information technology produced several challenges to build awareness of the unique challenges anomaly detection faces
reliable networks which are a very difficult task. There are when operating on network traffic. We note that our
many types of attacks threatening the availability, integrity examples from other domains are primarily for illustration,
and confidentiality of computer networks. The Denial of as there is of course a continuous spectrum for many of the
service attack (DOS) considered as one of the most common properties discussed (e.g., spam detection faces a similarly
harmful attacks. It can be surprising at first to realize that adversarial environment as intrusion detection does). We
despite extensive academic research efforts on anomaly also note that we are network security researchers, not
detection, the success of such systems in operational experts on machine-learning, and thus we argue mostly at an
environments has been very limited. In other domains, the intuitive level rather than attempting to frame our statements
very same machine learning tools that form the basis of in the formalisms employed for machine learning. However,
anomaly detection systems have proven to work with great based on discussions with colleagues who work with
success, and are regularly used in commercial settings where machine learning on a daily basis, we believe these intuitive
large quantities of data render manual inspection infeasible. arguments match well with what a more formal analysis

3
 A Survey on Effective Machine Learning Algorithm for Intrusion Detection System

would yield. For an anomaly detection system, a thorough [14] Mazyar Mohammadi Lisehroodi, Z. M. (2013) ―A hybrid framework
based on neural network mlp and kmeans clustering for intrusion
evaluation is particularly crucial to perform, as experience detection system‖. Proceedings of the 4th International Conference
shows that many promising approaches turn out in practice on Computing and Informatics, ICOCI 2013 (p. Paper No. 020).
to fall short of one‘s expectations. That said, devising sound Sarawak, Malaysia: Universiti Utara Malaysia.
evaluation schemes is not easy, and in fact turns out to be [15] A.M.Chandrashekhar, K. (2013) ―Fortification of hybrid intrusion
detection system using variants of neural networks & support vector
more difficult than building the detector itself. Due to the machines‖. International Journal of Network Security & Its
opacity of the detection process, the results of an anomaly Applications (IJNSA).
detection system are harder to predict than for a misuse [16] Denning, D. E. ―An intrusion-detection model. IEEE Transactions
detector. on Software Engineering‖ Special issue on computer security and
privacy 13, 2 (Feb. 1987), 222–232
[17] Corchado, E., And Herrero, ―A Neural visualization of network
IV. CONCLUSION traffic data for intrusion detection‖. Applied Soft Computing 11, 2
(Mar. 2011), 2042–2056.
The rise of the internet services along with the continued [18] Levent Koc, T. A. (2012) ―A network intrusion detection system
growth of access around the world, network traffic security based on a Hidden Naïve Bayes multiclass classifier‖. Expert
is becoming a major issue in computer network system. Systems with Applications, ELSEVIER.
Every day the number of attacks is increasing in computer [19] Mazyar Mohammadi Lisehroodi, Z. M. (2013) ―A hybrid framework
based on neural network mlp and kmeans clustering for intrusion
network. For the reason that Intrusion detection in network detection system‖. Proceedings of the 4th International Conference
is very important to detect and prevent intrusions and on Computing and Informatics, ICOCI 2013 (p. Paper No. 020).
analyse huge number of network data and classify all of Sarawak, Malaysia: Universiti Utara Malaysia
these network data into anomaly and normal data but [20] Crescenzo, G. D., Ghosh, A., And Talpade, R. ―Towards a theory of
intrusion detection‖. In 10th European Symposium on Research in
traditional IDS suffer from different problems that limit Computer Security ESORICS (2005), pp. 267–286
their effectiveness and efficiency. A Machine learning
researcher is to design more efficient IDS (in terms of both
time and space) and practical general purpose learning
methods that can perform better over a widespread domain.
In the context of Machine learning, the efficiency with
which a method utilises data resources that is also an
important performance paradigm along with time and space
complexity. Higher accuracy of prediction and humanly
interpretable prediction rules are also of high importance.

REFERENCES
[01] David Ahmad Effendy, Kusrini Kusrini, Sudarmawan Sudarmawan,
―Classification of Intrusion Detection System (IDS) Based on
Computer Network‖ in 2017 IEEE.
[02] Amreen Sultana, M.A.Jabbar, ―Intelligent Network Intrusion
Detection System is using Data Mining Techniques‖ in IEEE 2016.
[03] Dr. Uma Kumari, Uma Soni, ―A Review of Intrusion Detection
using Anomaly based Detection‖ in Proceedings of the 2nd
International Conference on Communication and Electronics
Systems (ICCES 2017) .
[04] James P. Anderson, "Computer security threat monitoring and
surveillance," Technical Report 98-17, James P. Anderson Co., Fort
Washington, Pennsylvania, USA, April 1980.
[05] Nawfal Turki Obeis and Wesam Bhaya, ―Review of Data Mining
Techniques for Malicious Detetion‖, Research journal of Applied
Sciences 11(10):942-947, 2016.
[06] Jau-Hwang WANG, Peter S. DENG, ―Virus Detection Using Data
Mining Techniques‖, TAO-Yuar, Taiwan, ROC333.
[07] Chi Zhang and Jinyuan Sun, ―Privacy and Security for Online Social
Networks: Challenges and Opportunity‖, Yuguang Fang, University
of Florida and Xidian University.
[08] Uma Salunkhe and Suresh N. Mali, ―Enrichment in Intrusion
Detection System Using Ensemble‖, Journal of Electrical and
computer Engineering.
[09] Q.S. Qassim, A. M. Zin and M. J. Ab Aziz, ―Anomalies
classification approach for network- based intrusion detection
system‖, International Journal of Network Security, pp.1159-1171,
2016.
[10] O.Y.Al-Jarrah, O. Alhussein, P.D.Yoo, S. Muhaidat, K.Taha and K.
Kim, ― Data Randomization and Cluster-based Partitioning for
botnet intrusion detection‖, IEEE Transactions on Cybernetics, vol.
46, no. 8, pp. 1796-1806, 2016.
[11] Solane Duque, Dr. Mohd. Nizam Bin Omar, ―Using Data Mining
Algorithm for Developing a Model for Intrusion Detection System
(IDS)‖, procedia Computer Science 61 (2015) 46-51
[12] Crescenzo, G. D., Ghosh, A., And Talpade, R. ―Towards a theory of
intrusion detection‖. In 10th European Symposium on Research in
Computer Security ESORICS (2005), pp. 267–286
[13] Wenying Feng, Q. Z. (2014) ―Mining network data for intrusion
detection through combining SVMs with ant colony networks‖.
Future Generation Computer Systems, ELSEVIER.