Distributed Online Averaged One Dependence Estimator (DOAODE) Algorithm for Multi-class Classification of Network Anomaly Detection System

1st International Conference on Mechanical Electronic and Biosystem Engineering

Nawir, Mukrimah^1 ; Amir, Amiza^1^2 ; Yaakob, Naimah^1 ; Rbadlishah, Ahmad^1^2 ; Mat Safar, Anuar^1 ; Mohd Warip, Mohd. Nazri^1 ; Zunaidi, I.^1^3

Embedded, Network and Advanced Computing (ENAC) Research Cluster, School of Computer and Communication Engineering, Universiti Malaysia Perlis (UniMAP), Pauh Putra, Perlis

02600, Malaysia^1

Faculty of Informatics and Computing, Universiti Sultan Zainal Abidin (UniSZA), Besut, Terengganu

22200, Malaysia^2

Faculty of Technology, University of Sunderland, St Peter's Campus, SR6 0DD, Sunderland, United Kingdom^3

关键词: Averaged one-dependence estimators;    Classification algorithm;    Difficulty to detect;    Distributed architecture;    Multi-class classification;    Multiclass networks;    Network anomaly detection;    Network monitoring systems;   

Others  :  https://iopscience.iop.org/article/10.1088/1757-899X/557/1/012015/pdf
DOI  :  10.1088/1757-899X/557/1/012015

来源: IOP

【 摘 要 】

Network monitoring system consists of large data streams, distributed architecture, and multiple computers that are geographically located all over the world caused a difficulty to detect abnormalities in the system. In addition, when handling network traffic, the data in network is fast incoming and requires an online learning where immediately response and predict the pattern of network traffic for classification once there is an event or request occur. Therefore, this paper aims to develop an effective and efficient network anomaly detection system by using distributed online averaged one dependence estimator (DOAODE) classification algorithm for multi-class network data to overcome these issues. The finding of DOAODE algorithm for multi-class classification is high in accuracy with average 83% and fast to train the network traffic recorded less than ten seconds and takes shorter time when the number of nodes increases.