Network Anomaly Intrusion Detection Using a Nonparametric Bayesian Approach and Feature Selection

IEEE Access

Abdullah ALharbi¹  Roobaea Alroobaea¹  Wajdi Alhakami¹  Sami Bourouis¹  Nizar Bouguila² 

[1] College of Computers and Information Technology, Taif University, Taif, Saudi Arabia;Concordia Institute for Information Systems Engineering (CIISE), Concordia University, Montreal, Canada;

关键词: Intrusion detection systems (IDS);    anomaly intrusion detection;    infinite mixture models;    bounded generalized Gaussian models;    Bayesian inference;    Markov chain Monte Carlo (MCMC);   

DOI  :  10.1109/ACCESS.2019.2912115

来源: DOAJ

【 摘 要 】

Anomaly-based intrusion detection systems (IDSs) have been deployed to monitor network activity and to protect systems and the Internet of Things (IoT) devices from attacks (or intrusions). The problem with these systems is that they generate a huge amount of inappropriate false alarms whenever abnormal activities are detected and they are not too flexible for a complex environment. The high-level rate of the generated false alarms reduces the performance of IDS against cyber-attacks and makes the tasks of the security analyst particularly difficult and the management of intrusion detection process computationally expensive. We study here one of the challenging aspects of computer and network security and we propose to build a detection model for both known and unknown intrusions (or anomaly detection) via a novel nonparametric Bayesian model. The design of our framework can be extended easily to be adequate for IoT technology and notably for intelligent smart city web-based applications. In our method, we learn the patterns of the activities (both normal and anomalous) through a Bayesian-based MCMC inference for infinite bounded generalized Gaussian mixture models. Contrary to classic clustering methods, our approach does not need to specify the number of clusters, takes into consideration the uncertainty via the introduction of prior knowledge for the parameters of the model, and permits to solve problems related to over- and under-fitting. In order to get better clustering performance, feature weights, model's parameters, and the number of clusters are estimated simultaneously and automatically. The developed approach was evaluated using popular data sets. The obtained results demonstrate the efficiency of our approach in detecting various attacks.

【 授权许可】

Unknown