Detection of Anomalies in the Computer Network Behaviour

Introduction

Intrusion detection systems (IDSs) protect computer networks from malicious activities which compromise network security and affect the confidentiality, integrity and availability of the data. IDSs can be grouped into the signature-based, anomaly-based, and hybrid (Ganpathy et al., 2015, 44-50).The basic idea of signature-based detection is to represent an attack in the form of pattern in such a way that any known attack and its variation can be detected. The main disadvantage of this approach is difficulty for detecting unknown attacks. Anomaly-based IDS detects changes in the network behaviour. The goal of anomaly-based detection is to build a statistical model that describes the normal behaviour of the computer network and then looks for activities which differ from the created model. It detects both intrusions and/or misuse, and classifies them as either ‘normal’ or ‘anomaly’. The biggest challenge in anomaly-based detection is to identify what is considered normal network behaviour. Machine learning (ML) models can be trained as binary classifiers in order to recognize the notion of normality. In a supervised ML, the data have to be collected over a period of time to create a model of normal behaviour of users, hosts, and networks.

A number of records needed for training the complex computer networks can be large, which makes evaluation of the IDS computationally expensive since the processing time and memory usage rise with a size of the dataset. In anomaly-based detection some of the recorded data can be discarded to decrease time needed for training and increase accuracy of IDSs. This paper presents one pre-processing technique applied to reduce the size of the Kyoto 2006+ dataset. The proposed algorithm cuts off all categorical features, features which are intended for further analyses of the evaluated models, and features containing instances which cannot be normalized into the range [-1, 1], excluding the feature ‘Label’ that flags either normal network behaviour or an anomaly (Ramasamy & Rani, 2018, 1060-1067). After the pre-processing, of 24 features describing each instance nine features left. In this paper we present results on the accuracy and computation time testing for five supervised learning models: k-Nearest Neighbour (k-NN), weighted k-NN (wk-NN), Support Vector Machine (SVM), Decision Tree and Feedforward Neural Network (FNN).

1. The Kyoto 2006+ Dataset

The Kyoto 2006+ dataset is built on the three years (November 2006 to August 2009) of the real network traffic data, collected on five different computer networks inside and outside the Kyoto University. The data set is designed to provide evaluation of the network-based intrusion detection systems (NIDS). It consists of 14 statistical features derived from the KDD Cup '99 dataset (1999) and 10 additional features which can be used for evaluation and further analyses of NIDS (Protic, 2018, 580-595). The Kyoto 2006+ dataset is captured using honeypots, darknet sensors, e-mail servers, web crawlers and other intrusion detection systems (Sing, 2014, 31-35). During the observation period, more than 50 million sessions of normal traffic, over 43 million sessions of known attacks and almost 426 thousand sessions of unknown attack were recorded (Song et al, 2011). Of the 41 features derived from the KDD Cup '99 dataset, authors discarded redundant data and content features which are not suitable for NIDS (See Table 1).

Table 1. First 14 features from the KDD Cup ‘99 dataset

(Source: Song et al., 2011)

In this way, the 14 features left consisted of one categorical feature ‘Flag’ and 13 continuous features. Moreover, authors extracted 10 additional features: ‘Label’ which indicated normal traffic or attacks, four features describing source and destination addresses and port numbers, two features describing start time and duration of the session, and three features for IDS, malware and Ashula detection (See Table 2).

Table 2. Additional features

(Source: Song et al., 2011)

2. Feature Selection

One of the major issues associated with the Kyoto 2006+ dataset is its size. Features selection reduces the data dimensionality by determining whether a feature is relevant or not for evaluation of the NIDS model. Using effective features in designing classifiers not only reduce the dataset but also improve performances of the classifier (Jayakumar, Revathi & Karpagam, 2015, 728-734).

In this paper we present two-step pre-processing algorithm for feature selection given as follows:

Step 1: Discard all categorical features and all features which are intended for further analyses, excluding feature ‘Label’.

Step 2: Cut features containing instances which cannot be normalized into the range [-1, 1].

Of the 24 features of the Kyoto 2006+ dataset, 17 features are discarded after the first algorithm step. Nine features (5-13) left after the pre-processing is done. These features are normalized to fall into the range [-1, 1] by applying the hyperbolic tangent function given with Eq. (1):

(1)

In this way the values of instances are scaled so that the effect of one feature cannot dominate the others. Moreover, normalized instances speed up FNN. Network training is more efficient when this pre-processing is performed on inputs. If the inputs are greater than 3 (e^-3≈0.05) sigmoid functions, which are used in the hidden network layer, become essentially saturated. If this happens at the beginning of the training process the gradients will be very small and the network training will be slow.

3. Machine Learning Models

Supervised ML algorithms use the known dataset to evaluate a model that generates prediction of unknown data. Assume that all data points belong either to the class ‘normal’ or class ‘anomaly’ (binary classification). Than each training data point x_i, from a vector of d-dimensional feature space, can be labelled by y_i as follows (see Eq. (2)):

(2)

The training dataset is denoted as follows .

This paper presents five models used for binary classification: k-NN, wk-NN (Hechenbichler & Schliep, 2004), SVM (Burgess, 1998, 283-298), Decision Tree (Sebastiani, 2002, 13) and FNN (Protic & Milosavljevic, 2006, 643-646).

3.1 K-Nearest Neighbour

k-NN is nonparametric method where new observation is placed into the class of observation from the learning set (Hechenbichler & Schliep, 2004). In this paper we present results on k-NN based prediction of unknown instances which finds the largest similarity of instances based on the Euclidean distance measure (Eq. (3)):

(3)

3.2 Weighted K-Nearest Neighbour

The main idea of wk-NN is to extend the k-NN method in so that the observations within the learning set, which are particularly close to the new observation, should get a higher weight in the decision than such neighbours which are more distant one from that observation (Hechenbichler & Schliep, 2004). To reach this aim the distances have to be transformed into the similarity measures (Eq. (4)), which can be used as weights (Eq. (5)):

(4)

(5)

3.3 Support Vector Machine

The goal of SVM algorithm is to find a hyperplane that distinctly classifies the data points into various classes (Burgess, 1998, 283-298). To separate instances into the classes ‘normal’ or ‘anomaly’ the algorithm finds a linear hyperplane that has the maximum distance ρ=2/||w|| between data points of both classes. For the training set

, the discriminant function takes the form (Eq. (6)):

(6)

where w is normal vector to the hyperplane that can be determined as follows (Eq. (7)):

(7)

The idea is to find min||w|| which maximizes the distance ρ.

3.4 Decision Tree

Decision Tree prediction is based on the principle of recursive partitioning by monitoring decisions from the root to the last node (Sebastiani, 2002, 13). It is one of the graph-like algorithms which use branching methods to illustrate every possible outcome of the decisions, where nodes represent features, links represent decision rules and leafs represent the outcomes. In the experiments we applied the Iterative Dichotomy 3 algorithm (ID3) (Colin, 1996, 107-110) which calculates entropy and information gain to build a tree. Entropy is a measure which controls how the tree decides to split the data. If the target feature can take on k different values then entropy of S relative to this k-wise classification can be calculated as follows (Eq. (8)):

(8)

where p_i is the proportion S belonging to class i. Information gain represents expected reduction in entropy based on the decrease in entropy after the dataset is split on the feature. The feature with highest information gain will split first. Information gain can be calculated with the formula (Eq. (9)):

(9)

Gain(S, A) of a feature A relative to a collection of examples S provides information about the target function value, given the value of some other feature A (when A splits the set S into the subsets S_v).

3.5 Feedforward Neural Network

FNN is based on the back-propagation algorithm. The nonlinear transfer function of the FNN is given with Eq. (10):

(10)

where x_l are inputs, y_i are outputs, w and W are weight matrices, f_j and F_i denote transfer functions of hidden and output layers, m represents the number of inputs, q represents the number of outputs, and w_j0 and W_f0 denote biases (Protic & Milosavljevic, 2006, 643-646). The objective of FNN presented in this paper is to minimize output error in accordance with the Levenberg-Marquardt algorithm (Protic, 2015, 11-28). It should be pointed out that the FNN has to be large enough to improve network generalization and provide an adequate fit.

4. Results

In our experiments, performances of the models are measured based on accuracy (ACC), which represents the ratio of number of instances correctly classified to the total number of instances given with Eq. (11) (Ambedkar & Babu, 2015, 25-29):

(11)

where true positive (TP), true negative (TN), false positive (FP) and false negative (FN) denote detected network behaviour as follows:

TP – ‘anomaly’ is detected as ‘anomaly’,

TN – ‘normal’ is detected as ‘normal’,

FP – ‘normal’ is detected as ‘anomaly’ and

FN – ‘anomaly’ is detected as ‘normal’.

In our previous work we have presented results based on normalized and not-normalized dataset of instances and four ML models, namely k-NN, wk-NN, SVM and Decision Tree (Protic & Stankovic, 2018, 43-48). Here we present results of the experiments conducted to the normalized instances and five models: k-NN, wk-NN, SVM, Decision Tree and FNN. Accuracy of the models and the corresponding computation time (sum of training, testing and validation time) are given in Table 3.

Table 3. Accuracy and computation time

The experiments are conducted on 10-days records from the Kyoto 2006+ dataset (991.395 instances in total). All models are trained so that out of the total number of randomly selected instances 70% are used for training, 15% for testing and 15% for validation of the models. Experiments are performed using Intel(R) Core(TM) i7-2620M CPU 2.70GHz processor with 16GB RAM Installed Memory.

Results show the highest accuracy (99.5%) of wk-NN model. The results also point to high accuracy for k-NN model (99.36%). Computation time for evaluating Decision Tree model is significantly shorter comparing to the computation time for other model’s evaluation, except for the FNN. Number of parameters in the network structure with nine inputs, one hidden-layer and one output is large enough to provide an adequate fit. The highest accuracy of FNN (99.21%) is achieved when the network is trained with the largest subset (136.625 instances in total). As expected, the time period needed for network learning is longer than for the networks trained with the smaller datasets (20s). Time period of training, testing and validating the FNN is significantly shorter than k-NN, wk-NN and SVM, and fall into the range [2s, 26s]. The results also show that the SVM model has a lower accuracy and longer computation time comparing to the other models.

Conclusion

Anomaly-based intrusion detection systems recognize deviations from normal computer network behaviour. A main challenge in anomaly-based detection is to determine the normal network behaviour and flag the anomaly. Machine learning models can be trained to classify the data into categories ‘normal’ or ‘anomaly’. In supervised machine learning the data have to be recorded over a period of time to create a model of normal behaviour. This process can take significant time and may be computationally expensive for complex computer networks. To decrease the period of learning and increase the accuracy of the model the number of features can be significantly reduced. In this paper, we present one pre-processing technique based on the feature selection. A subset containing nine features and normalized instances is used for evaluation of IDSs based on k-NN, wk-NN, SVM, Decision Tree and FNN models. The results show that the highest accuracy gives the wk-NN model, while the shortest computation time has Decision Tree model. Overall, FNN shows higher accuracy and shorter computation time, compared to the other models. In our further work we will present the results of experiments conducted on hybrid model based on wk-NN and FNN which detects variation in the decision on detected anomalies.

References