Skip to main content
Top

2020 | OriginalPaper | Chapter

Taxonomy of Supervised Machine Learning for Intrusion Detection Systems

Authors : Ahmed Ahmim, Mohamed Amine Ferrag, Leandros Maglaras, Makhlouf Derdour, Helge Janicke, George Drivas

Published in: Strategic Innovative Marketing and Tourism

Publisher: Springer International Publishing

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

This paper presents a taxonomy of supervised machine learning techniques for intrusion detection systems (IDSs). Firstly, detailed information about related studies is provided. Secondly, a brief review of public data sets is provided, which are used in experiments and frequently cited in publications, including, IDEVAL, KDD CUP 1999, UNM Send-Mail Data, NSL-KDD, and CICIDS2017. Thirdly, IDSs based on supervised machine learning are presented. Finally, analysis and comparison of each IDS along with their pros and cons are provided.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literature
1.
go back to reference Death D (2017) Information security handbook: develop a threat model and incident response strategy to build a strong information security framework. Packt Publishing Ltd., Birmingham Death D (2017) Information security handbook: develop a threat model and incident response strategy to build a strong information security framework. Packt Publishing Ltd., Birmingham
2.
go back to reference Maglaras LA, Jiang J (2014) Intrusion detection in SCADA systems using machine learning techniques. In: 2014 science and information conference. IEEE, Piscataway, pp 626–631CrossRef Maglaras LA, Jiang J (2014) Intrusion detection in SCADA systems using machine learning techniques. In: 2014 science and information conference. IEEE, Piscataway, pp 626–631CrossRef
3.
go back to reference European Union Agency for Network and Information Security (2018) ENISA threat landscape report 2018 European Union Agency for Network and Information Security (2018) ENISA threat landscape report 2018
4.
go back to reference Garcia-Teodoro P, Diaz-Verdejo J, Maciá-Fernández G, Vázquez E (2009) Anomaly-based network intrusion detection: techniques, systems and challenges. Comput Secur 28:18–28CrossRef Garcia-Teodoro P, Diaz-Verdejo J, Maciá-Fernández G, Vázquez E (2009) Anomaly-based network intrusion detection: techniques, systems and challenges. Comput Secur 28:18–28CrossRef
5.
go back to reference Zhou CV, Leckie C, Karunasekera S (2010) A survey of coordinated attacks and collaborative intrusion detection. Comput Secur 29:124–140CrossRef Zhou CV, Leckie C, Karunasekera S (2010) A survey of coordinated attacks and collaborative intrusion detection. Comput Secur 29:124–140CrossRef
6.
go back to reference Elshoush HT, Osman IM (2011) Alert correlation in collaborative intelligent intrusion detection systems - a survey. Appl Soft Comput 11:4349–4365CrossRef Elshoush HT, Osman IM (2011) Alert correlation in collaborative intelligent intrusion detection systems - a survey. Appl Soft Comput 11:4349–4365CrossRef
7.
go back to reference Sperotto A, Schaffrath G, Sadre R, Morariu C, Pras A, Stiller B (2010) An overview of IP flow-based intrusion detection. IEEE Commun Surv Tutorials 12:343–356CrossRef Sperotto A, Schaffrath G, Sadre R, Morariu C, Pras A, Stiller B (2010) An overview of IP flow-based intrusion detection. IEEE Commun Surv Tutorials 12:343–356CrossRef
8.
go back to reference Modi C, Patel D, Borisaniya B, Patel H, Patel A, Rajarajan M (2013) A survey of intrusion detection techniques in cloud. J Netw Comput Appl 36:42–57CrossRef Modi C, Patel D, Borisaniya B, Patel H, Patel A, Rajarajan M (2013) A survey of intrusion detection techniques in cloud. J Netw Comput Appl 36:42–57CrossRef
9.
go back to reference Ferrag MA, Maglaras LA, Janicke H, Jiang J, Shu L (2017) Authentication protocols for internet of things: a comprehensive survey. Secur Commun Netw 2017:41 ppCrossRef Ferrag MA, Maglaras LA, Janicke H, Jiang J, Shu L (2017) Authentication protocols for internet of things: a comprehensive survey. Secur Commun Netw 2017:41 ppCrossRef
10.
go back to reference Ferrag MA, Maglaras LA, Janicke H, Jiang J, Shu L (2018) A systematic review of data protection and privacy preservation schemes for smart grid communications. Sustain Cities Soc 38:806–835CrossRef Ferrag MA, Maglaras LA, Janicke H, Jiang J, Shu L (2018) A systematic review of data protection and privacy preservation schemes for smart grid communications. Sustain Cities Soc 38:806–835CrossRef
11.
go back to reference Ferrag MA, Maglaras L, Ahmim A (2017) Privacy-preserving schemes for ad hoc social networks: a survey. IEEE Commun Surv Tutorials 19:3015–3045CrossRef Ferrag MA, Maglaras L, Ahmim A (2017) Privacy-preserving schemes for ad hoc social networks: a survey. IEEE Commun Surv Tutorials 19:3015–3045CrossRef
12.
go back to reference Butun I, Morgera SD, Sankar R (2014) A survey of intrusion detection systems in wireless sensor networks. IEEE Commun Surv Tutorials 16:266–282CrossRef Butun I, Morgera SD, Sankar R (2014) A survey of intrusion detection systems in wireless sensor networks. IEEE Commun Surv Tutorials 16:266–282CrossRef
13.
go back to reference Vasilomanolakis E, Karuppayah S, Mühlhäuser M, Fischer M (2015) Taxonomy and survey of collaborative intrusion detection. ACM Comput Surv 47:55CrossRef Vasilomanolakis E, Karuppayah S, Mühlhäuser M, Fischer M (2015) Taxonomy and survey of collaborative intrusion detection. ACM Comput Surv 47:55CrossRef
14.
go back to reference Milenkoski A, Vieira M, Kounev S, Avritzer A, Payne BD (2015) Evaluating computer intrusion detection systems: a survey of common practices. ACM Comput Surv 48:12CrossRef Milenkoski A, Vieira M, Kounev S, Avritzer A, Payne BD (2015) Evaluating computer intrusion detection systems: a survey of common practices. ACM Comput Surv 48:12CrossRef
15.
go back to reference Buczak AL, Guven E (2016) A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Commun Surv Tutorials 18:1153–1176CrossRef Buczak AL, Guven E (2016) A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Commun Surv Tutorials 18:1153–1176CrossRef
16.
go back to reference Ahmed M, Mahmood AN, Hu J (2016) A survey of network anomaly detection techniques. J Netw Comput Appl 60:19–31CrossRef Ahmed M, Mahmood AN, Hu J (2016) A survey of network anomaly detection techniques. J Netw Comput Appl 60:19–31CrossRef
17.
go back to reference Sharafaldin I, Lashkari AH, Ghorbani AA (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: ICISSP, pp 108–116 Sharafaldin I, Lashkari AH, Ghorbani AA (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: ICISSP, pp 108–116
18.
go back to reference Cannady J (1998) Artificial neural networks for misuse detection. In: National information systems security conference, Baltimore, vol. 26 Cannady J (1998) Artificial neural networks for misuse detection. In: National information systems security conference, Baltimore, vol. 26
19.
go back to reference Lippmann RP, Cunningham RK (2000) Improving intrusion detection performance using keyword selection and neural networks. Comput Netw 34:597–603CrossRef Lippmann RP, Cunningham RK (2000) Improving intrusion detection performance using keyword selection and neural networks. Comput Netw 34:597–603CrossRef
20.
go back to reference Bivens A, Palagiri C, Smith R, Szymanski B, Embrechts M, et al (2002) Network-based intrusion detection using neural networks. In: Intelligent engineering systems through artificial neural networks, vol 12, pp 579–584 Bivens A, Palagiri C, Smith R, Szymanski B, Embrechts M, et al (2002) Network-based intrusion detection using neural networks. In: Intelligent engineering systems through artificial neural networks, vol 12, pp 579–584
21.
go back to reference Kruegel C, Mutz D, Robertson W, Valeur F (2003) Bayesian event classification for intrusion detection. In: 19th annual computer security applications conference, 2003. Proceedings. IEEE, Piscataway, pp 14–23CrossRef Kruegel C, Mutz D, Robertson W, Valeur F (2003) Bayesian event classification for intrusion detection. In: 19th annual computer security applications conference, 2003. Proceedings. IEEE, Piscataway, pp 14–23CrossRef
22.
go back to reference Kruegel C, Toth T (2003) Using decision trees to improve signature-based intrusion detection. In: International workshop on recent advances in intrusion detection. Springer, Berlin, pp 173–191CrossRef Kruegel C, Toth T (2003) Using decision trees to improve signature-based intrusion detection. In: International workshop on recent advances in intrusion detection. Springer, Berlin, pp 173–191CrossRef
23.
go back to reference Benferhat S, Kenaza T, Mokhtari A (2008) A naive Bayes approach for detecting coordinated attacks. In: 2008 32nd annual IEEE international computer software and applications conference. IEEE, Piscataway, pp 704–709CrossRef Benferhat S, Kenaza T, Mokhtari A (2008) A naive Bayes approach for detecting coordinated attacks. In: 2008 32nd annual IEEE international computer software and applications conference. IEEE, Piscataway, pp 704–709CrossRef
24.
go back to reference Apiletti D, Baralis E, Cerquitelli T, DElia V (2009) Characterizing network traffic by means of the NetMine framework. Comput Netw 53:774–789CrossRef Apiletti D, Baralis E, Cerquitelli T, DElia V (2009) Characterizing network traffic by means of the NetMine framework. Comput Netw 53:774–789CrossRef
25.
go back to reference Amiri F, Yousefi MR, Lucas C, Shakery A, Yazdani N (2011) Mutual information-based feature selection for intrusion detection systems. J Netw Comput Appl 34:1184–1199CrossRef Amiri F, Yousefi MR, Lucas C, Shakery A, Yazdani N (2011) Mutual information-based feature selection for intrusion detection systems. J Netw Comput Appl 34:1184–1199CrossRef
26.
go back to reference Brahmi H, Brahmi I, Yahia SB (2012) OMC-IDS: at the cross-roads of OLAP mining and intrusion detection. In: Pacific-Asia conference on knowledge discovery and data mining. Springer, Berlin, pp 13–24CrossRef Brahmi H, Brahmi I, Yahia SB (2012) OMC-IDS: at the cross-roads of OLAP mining and intrusion detection. In: Pacific-Asia conference on knowledge discovery and data mining. Springer, Berlin, pp 13–24CrossRef
27.
go back to reference Li Y, Xia J, Zhang S, Yan J, Ai X, Dai K (2012) An efficient intrusion detection system based on support vector machines and gradually feature removal method. Expert Syst Appl 39:424–430CrossRef Li Y, Xia J, Zhang S, Yan J, Ai X, Dai K (2012) An efficient intrusion detection system based on support vector machines and gradually feature removal method. Expert Syst Appl 39:424–430CrossRef
28.
go back to reference Bilge L, Sen S, Balzarotti D, Kirda E, Kruegel C (2014) Exposure: a passive DNS analysis service to detect and report malicious domains. ACM Trans Inf Syst Secur 16:14CrossRef Bilge L, Sen S, Balzarotti D, Kirda E, Kruegel C (2014) Exposure: a passive DNS analysis service to detect and report malicious domains. ACM Trans Inf Syst Secur 16:14CrossRef
29.
go back to reference Aljawarneh S, Aldwairi M, Yassein MB (2018) Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model. J Comput Sci 25:152–160CrossRef Aljawarneh S, Aldwairi M, Yassein MB (2018) Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model. J Comput Sci 25:152–160CrossRef
30.
go back to reference Ahmim A, Maglaras L, Ferrag MA, Derdour M, Janicke H (2018) A novel hierarchical intrusion detection system based on decision tree and rules-based models. Preprint arXiv:1812.09059 Ahmim A, Maglaras L, Ferrag MA, Derdour M, Janicke H (2018) A novel hierarchical intrusion detection system based on decision tree and rules-based models. Preprint arXiv:1812.09059
Metadata
Title
Taxonomy of Supervised Machine Learning for Intrusion Detection Systems
Authors
Ahmed Ahmim
Mohamed Amine Ferrag
Leandros Maglaras
Makhlouf Derdour
Helge Janicke
George Drivas
Copyright Year
2020
DOI
https://doi.org/10.1007/978-3-030-36126-6_69