Semi-supervised multi-layered clustering model for intrusion detection

• 作者: Mahmoud Al-Qutayri Omar Y.Al-Jarrah Patti D.Yoo Sami Muhaidat Yousof A1-Hammdi
• 来源期刊: 数字通信与网络:英文版
• 学科: 工学
• 关键词: SEMI-SUPERVISED INTRUSION detection MACHINE learning Classification ENSEMBLES BIG data
• 年，卷（期）: 2018,（4）
• 页码范围: 277-286
• 页数: 10页
• 分类号: TN

摘要

A Machine Learning (ML)-based Intrusion Detection and Prevention System (IDPS)requires a large amount of labeled up-to-date training data to effectively detect intrusions and generalize well to novel attacks.However,the labeling of data is costly and becomes infeasible when dealing with big data,such as those generated by Intemet of Things applications.To this effect,building an ML model that learns from non-labeled or partially labeled data is of critical importance.This paper proposes a Semi-supervised Mniti-Layered Clustering ((SMLC))model for the detection and prevention of network intrusion.SMLC has the capability to learn from partially labeled data while achieving a detection performance comparable to that of supervised ML-based IDPS.The performance of SMLC is compared with that of a well-known semi-supervised model (tri-training)and of supervised ensemble ML models, namely Random.Forest,Bagging,and AdaboostM1on two benchmark network-intrusion datasets,NSL and Kyoto 2006+.Experimental resnits show that SMLC is superior to tri-training,providing a comparable detection accuracy with 20%less labeled instances of training data.Furthermore,our results demonstrate that our scheme has a detection accuracy comparable to that of the supervised ensemble models.