تشخیص نفوذ و ناهنجاری ها با استفاده از داده کاوی و انتخاب ویژگی ها بوسیله الگوریتم PSO
محورهای موضوعی : فناوری اطلاعات و ارتباطاتفریدون رضائی 1 , محمدعلی افشار کاظمی 2 * , محمد علی کرامتی 3
1 - گروه مدیریت فناوری اطلاعات، دانشگاه آزاد اسلامی واحد تهران مرکز
2 - دانشگاه آزاد اسلامی تهران مرکزی
3 - گروه مدیریت صنعتی
کلید واژه: PSO, J48, داده‌کاوی, حملات سایبری, NLC-KDD,
چکیده مقاله :
امروزه با توجه به پیشرفت فناوری و توسعه استفاده از اینترنت در کسب و کارها و تغییر نوع کسب و کارها از حالت فیزیکی به مجازی و اینترنت، باعث شده است که نوع حملات و ناهنجاری‌های مرتبط نیز از حالت فیزیکی به حالت مجازی تغییر کند. یعنی بجای دستبرد به یک فروشگاه یا مغازه، افراد با استفاده از حملات سایبری به سایت‌ها و فروشگاه‌های مجازی نفوذ کرده و در آنها اخلال ایجاد می‌کنند. آشکارسازی حملات و ناهنجاری‌ها یکی از چالش‌های جدید در مسیر پیشبرد تکنولوژی تجارت الکترونیک می‌باشد. تشخیص ناهنجاری‌های یک شبکه و فرآیند شناسایی فعالیت‌های مخرب در کسب و کارهای تجارت الکترونیک با تجزیه و تحلیل رفتار ترافیک شبکه امکان‌پذیر است. سیستمهای داده‌کاوی بطور گسترده‌ای در سیستمهای تشخیص نفوذ (IDS) برای تشخیص ناهنجاری‌ها استفاده می‌شوند. کاهش ابعاد ویژگی‌ها نقش بسیار مهمی در تشخیص نفوذ ایفا می‌کند، زیرا تشخیص ناهنجاری‌ها از ویژگی‌های ترافیک شبکه با ابعاد بالا فرآیندی زمان‌بری است. انتخاب ویژگی‌های درست و مناسب بر سرعت تجزیه و تحلیل و کار پیشنهادی تاثیر می‌گذارد و می‌تواند سرعت تشخیص را بهبود بخشد. در این مقاله با استفاده از الگوریتم‌های داده‌کاوی مانند بیزین، پرسپترون چندلایه، CFS، Best First، J48 و PSO، میزان دقت تشخیص ناهنجاری‌ها و حملات به 0.996 و میزان خطای آن 0.004 رسانده شده است.
Today, considering technology development, increased use of Internet in businesses, and movement of business types from physical to virtual and internet, attacks and anomalies have also changed from physical to virtual. That is, instead of thieving a store or market, the individuals intrude the websites and virtual markets through cyberattacks and disrupt them. Detection of attacks and anomalies is one of the new challenges in promoting e-commerce technologies. Detecting anomalies of a network and the process of detecting destructive activities in e-commerce can be executed by analyzing the behavior of network traffic. Data mining systems/techniques are used extensively in intrusion detection systems (IDS) in order to detect anomalies. Reducing the size/dimensions of features plays an important role in intrusion detection since detecting anomalies, which are features of network traffic with high dimensions, is a time-consuming process. Choosing suitable and accurate features influences the speed of the proposed task/work analysis, resulting in an improved speed of detection. In this article, by using data mining algorithms such as Bayesian, Multilayer Perceptron, CFS, Best First, J48 and PSO, we were able to increase the accuracy of detecting anomalies and attacks to 0.996 and the error rate to 0.004.
[1] Abdelhamid, N., Ayesh, A., Thabtah, F., “Phishing detection based Associative Classification data mining”, Expert Systems with Applications 41 5948–5959, 2014.
[2] Rezaei F, Afshar Kazemi M A, Keramati M A. Detection of E-commerce Attacks and Anomalies using Adaptive Neuro-Fuzzy Inference System and Firefly Optimization Algorithm . itrc 2021; 13 (1) :32-39
URL: http://ijict.itrc.ac.ir/article-1-477-en.html
[3] Hasan, Mahmudul, et al. "Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches." Internet of Things 7 (2019): 100059.
[4] Kotenko, Igor, et al. "Attack detection in IoT critical infrastructures: a machine learning and big data processing approach." 2019 27th Euromicro International Conference on Parallel, Distributed and NetworkBased Processing (PDP). IEEE, 2019.
[5] Foley, John, Naghmeh Moradpoor, and Henry Ochen. "Employing a Machine Learning Approach to Detect Combined Internet of Things Attacks against Two Objective Functions Using a Novel Dataset." Security and Communication Networks 2020 (2020).
[6] Assistant, Masoud, "Detection of attacks in electronic banking using fuzzy-rough combined system" computer department of Imam Reza University (AS), 2014.
[7] Al-jarrah, O., Arafat, A., “Network Intrusion Detection System using attack behavior classification.”, Paper presented at the Information and Communication Systems (ICICS), 2014 5th International Conference on.
[8] Kohavi, R., John, G. H., “Wrappers for feature subset selection”, Artificial Intelligence,Vol. 97, pp. 273-324, 1997.
[9] Doshi, Rohan, Noah Apthorpe, and Nick Feamster. "Machine learning ddos detection for onsumer internet of things devices." 2018 IEEE Security and Privacy Workshops (SPW). IEEE, 2018.
[10] Syed, Naeem Firdous, et al. "Denial of service attack detection through machine learning for the IoT." Journal of Information and Telecommunication (2020): 1-22.
[11] Manimurugan, S., et al. "Effective Attack Detection in Internet of Medical Things Smart Environment Using a Deep Belief Neural Network." IEEE Access 8 (2020): 77396-77404.
[12] Latif, Shahid, et al. "A Novel Attack Detection Scheme for the Industrial Internet of Things Using a Lightweight Random Neural Network." IEEE Access 8 (2020): 89337-89350.
[13] Singh, P., Jain, N., Maini, A., “Investigating the Effect Of Feature Selection and Dimensionality Reduction On Phishing Website Classification Problem”, 1st International Conference on Next Generation Computing Technologies (NGCT) Dehradun, India, IEEE, pp. 388-393, 2015.
[14] Alizadeh Bahrami, Karimi, Abdullahi Fard, "J48 Decision Tree in Intelligent Intrusion Detection Systems", National Conference on New Researches in Electrical, Computer and Medical Engineering, Islamic Azad University, Kazeroon Branch, July 27, 2016
[15] Baharlo, Yari, "Improving the method of identifying phishing websites using data mining on web pages", two scientific quarterly magazines of Iran Information and Communication Technology, Iran Information and Communication Technology Association, 12th year, numbers 43 and 44, Spring and summer 2019, pages 27-38
[16] K. L. Chiew, C. L. Tan, K. Wong, K. S. Yong, and W. K. Tiong, “A new hybrid ensemble feature selection framework for machine learningbased phishing detection system,” Information Sciences, vol. 484, pp. 153–166, 2019.
[17] M. Almseidin, A. A. Zuraiq, M. Alkasassbeh, and N. Alnidami, “Phishing detection based on machine learning and feature selection methods,” International Journal of Interactive Mobile Technologies (iJIM), vol. 13, no. 12, pp. 171–183, 2019.
[18] Meenu , Sunila godara, “Phishing Detection using Machine Learning Techniques”, International Journal of Engineering and Advanced Technology (IJEAT) , Volume-9 Issue-2, December, 2019.
[19] S. Revathi, Dr. A. Malathi, “A Detailed Analysis on NSL-KDD Dataset Using Various Machine Learning Techniques for Intrusion Detection”, International Journal of Engineering Research & Technology (IJERT), ISSN: 2278-0181, Vol. 2 ISSue 12, December-2013
[20] Rouhaninejad, Tayyaba, 2014, Combining Decision Tree and Bayesian Data Mining Algorithms in Intrusion Detection, Second National Conference on Computer Engineering and Information Technology Management, Tehran, https://civilica.com/doc/422878
[21] Fatemeh Mirjalili & Jafar Razmara, “An intelligent behavior-based intrusion detection method for virtual machines “, Signal and data processing journal, 2021, number 2, serial 48