Due to the great increase in the amount of attacks that occur in computer networks, there is an increasing dependence on network intrusion detection systems which monitor and analyze the network data to detect attacks. In recent years, machine learning methods have been used to build predictive models for network intrusion detection. These methods are able to automatically extract patterns from the network data to build detection models. Defining proper features, which help models to better discriminate between normal and attack data, is a critical task. While network attacks vary widely, they share some commonalities. Many attacks, by their nature, are repetitive and exhibit behaviors different from normal traffic. Among these commonalities are self-similarity between attack packets, periodicity and repetition characteristics seen in the attack traffic. In this paper, we study the common behaviors between two different attack types, called RUDY and DNS Amplification attacks, in order to propose new features for building predictive models by using machine learning algorithms. We collected Netflow traffic from an operational ISP network. We introduce a concept called “session” derived from Netflow which incorporates both sides of a network communication to define a network instance. Features are extracted for each session. To demonstrate how the newly defined features work for the task of intrusion detection, we use these features to build intrusion detection models for the detection of RUDY attack, DNS Amplification attack and the combination of these two attacks. To build predictive models we apply four machine learning classification algorithms: two versions of a decision tree algorithm, Naïve Bayes and 5-Nearest Neighbor (5-NN) algorithm. Our results show that the proposed features based on the attack commonalities provide very good prediction results for the detection of two studied attacks on real network traffic.
原文链接
分享
引用
