Abstract:The intrusion detection in computer networks is a complex research problem, which requires the understanding of computer networks and the mechanism of intrusions, the configuration of sensors and the collected data, the selection of the relevant attributes, and the monitor algorithms for online detection. It is critical to develop general methods for data dimension reduction, effective monitoring algorithms for intrusion detection, and means for their performance improvement. This dissertation is motivated by the timely need to develop statistics-based machine learning methods for effective detection of computer network anomalies. Three fundamental research issues related to data dimension reduction, control charts design and performance improvement have been addressed accordingly. The major research activities and corresponding contributions are summarized as follows: (1) Filter and Wrapper models are integrated to extract a small number of the informative attributes for computer network intrusion detection. A two-phase analyses method is proposed for the integration of Filter and Wrapper models. The proposed method has successfully reduced the original 41 attributes to 12 informative attributes while increasing the accuracy of the model. The comparison of the results in each phase shows the effectiveness of the proposed method. (2) Supervised kernel based control charts for anomaly intrusion detection. We propose to construct control charts in a feature space. The first contribution is the use of multi-objective Genetic Algorithm in the parameter pre-selection for SVM based control charts. The second contribution is the performance evaluation of supervised kernel based control charts. (3) Unsupervised kernel based control charts for anomaly intrusion detection. Two types of unsupervised kernel based control charts are investigated: Kernel PCA control charts and Support Vector Clustering based control charts. The applications of SVC based control charts on computer networks audit data are also discussed to demonstrate the effectiveness of the proposed method. Although the developed methodologies in this dissertation are demonstrated in the computer network intrusion detection applications, the methodologies are also expected to be applied to other complex system monitoring, where the database consists of a large dimensional data with non-Gaussian distribution.

Normalized Method of Intrusion Detection Data Based on Information Theory in Big Data Environment

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

A method of SVM with Normalization in Intrusion Detection

An Agile Approach to Identify Single and Hybrid Normalization for Enhancing Machine Learning-Based Network Intrusion Detection

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

Learning to Detect: A Data-driven Approach for Network Intrusion Detection

Investigation of The Effect of Data Normalization on Classification and Feature Selection in Intrusion Detection System

Application and Performance Analysis of Data Preprocessing for Intrusion Detection System.

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data

Network Data Classification Mechanism for Intrusion Detection System

Network intrusion detection based on IE-DBN model

Imbalanced data classification: A KNN and generative adversarial networks-based hybrid approach for intrusion detection

1D CNN Based Network Intrusion Detection with Normalization on Imbalanced Data

An Industrial Network Intrusion Detection Algorithm Based on Multifeature Data Clustering Optimization Model

A computationally efficient dimensionality reduction and attack classification approach for network intrusion detection

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Network Intrusion Traffic Detection Based on Feature Extraction

Big data analysis and distributed deep learning for next-generation intrusion detection system optimization

Explaining the Attributes of a Deep Learning Based Intrusion Detection System for Industrial Control Networks

A multiscale approach for network intrusion detection based on variance–covariance subspace distance and EQL v2

Anomaly detection through statistics-based machine learning for computer networks