Cover Image

Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring

Multivariate control charts have been applied in many sectors. One of the sectors that employ this method is network intrusion detection. However, the issue arises when the conventional control chart faces difficulty monitoring the network-traffic data that do not follow a normal distribution as req...

Full description

Saved in:
Bibliographic Details
Main Authors: Muhammad Ahsan, Muhammad Ahsan, Hidayatul Khusna, Hidayatul Khusna, Wibawati, Wibawati, Lee, Muhammad Hisyam
Format: Article
Language:English
Published: Springer Nature 2023
Subjects:
QA Mathematics
Online Access:http://eprints.utm.my/106889/1/MuhammadHisyamLee2023_SupportVectorDataDescriptionwithKernel.pdf
http://eprints.utm.my/106889/
http://dx.doi.org/10.1038/s41598-023-46719-3
Tags: Add Tag
No Tags, Be the first to tag this record!
id my.utm.106889
record_format eprints
spelling my.utm.1068892024-08-01T05:48:04Z http://eprints.utm.my/106889/ Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring Muhammad Ahsan, Muhammad Ahsan Hidayatul Khusna, Hidayatul Khusna Wibawati, Wibawati Lee, Muhammad Hisyam QA Mathematics Multivariate control charts have been applied in many sectors. One of the sectors that employ this method is network intrusion detection. However, the issue arises when the conventional control chart faces difficulty monitoring the network-traffic data that do not follow a normal distribution as required. Consequently, more false alarms will be found when inspecting network traffic data. To settle this problem, support vector data description (SVDD) is suggested. The control chart based on the SVDD distance can be applied for the non-normal distribution, even the unknown distributions. Kernel density estimation (KDE) is the nonparametric approach that can be applied in estimating the control limit of the non-parametric control charts. Based on these facts, a multivariate chart based on the integrated SVDD and KDE (SVDD-KDE) is proposed to monitor the network's anomaly. Simulation using the synthetic dataset is performed to examine the performance of the SVDD-KDE chart in detecting multivariate data shifts and outliers. Based on the simulation results, the proposed method produces better performance in detecting shifts and higher accuracy in detecting outliers. Further, the proposed method is applied in the intrusion detection system (IDS) to monitor network attacks. The NSL-KDD data is analyzed as the benchmark dataset. A comparison between the SVDD-KDE chart with the other IDS-based-control chart and the machine learning algorithms is executed. Although the it has high computational cost, the results show that the IDS based on the SVDD-KDE chart produces a high accuracy at 0.917 and AUC at 0.915 with a low false positive rate compared to several algorithms. Springer Nature 2023-11-06 Article PeerReviewed application/pdf en http://eprints.utm.my/106889/1/MuhammadHisyamLee2023_SupportVectorDataDescriptionwithKernel.pdf Muhammad Ahsan, Muhammad Ahsan and Hidayatul Khusna, Hidayatul Khusna and Wibawati, Wibawati and Lee, Muhammad Hisyam (2023) Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring. Scientific Reports, 13 (1). pp. 1-12. ISSN 2045-2322 http://dx.doi.org/10.1038/s41598-023-46719-3 DOI:10.1038/s41598-023-46719-3
institution Universiti Teknologi Malaysia
building UTM Library
collection Institutional Repository
continent Asia
country Malaysia
content_provider Universiti Teknologi Malaysia
content_source UTM Institutional Repository
url_provider http://eprints.utm.my/
language English
topic QA Mathematics
spellingShingle QA Mathematics
Muhammad Ahsan, Muhammad Ahsan
Hidayatul Khusna, Hidayatul Khusna
Wibawati, Wibawati
Lee, Muhammad Hisyam
Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring
description Multivariate control charts have been applied in many sectors. One of the sectors that employ this method is network intrusion detection. However, the issue arises when the conventional control chart faces difficulty monitoring the network-traffic data that do not follow a normal distribution as required. Consequently, more false alarms will be found when inspecting network traffic data. To settle this problem, support vector data description (SVDD) is suggested. The control chart based on the SVDD distance can be applied for the non-normal distribution, even the unknown distributions. Kernel density estimation (KDE) is the nonparametric approach that can be applied in estimating the control limit of the non-parametric control charts. Based on these facts, a multivariate chart based on the integrated SVDD and KDE (SVDD-KDE) is proposed to monitor the network's anomaly. Simulation using the synthetic dataset is performed to examine the performance of the SVDD-KDE chart in detecting multivariate data shifts and outliers. Based on the simulation results, the proposed method produces better performance in detecting shifts and higher accuracy in detecting outliers. Further, the proposed method is applied in the intrusion detection system (IDS) to monitor network attacks. The NSL-KDD data is analyzed as the benchmark dataset. A comparison between the SVDD-KDE chart with the other IDS-based-control chart and the machine learning algorithms is executed. Although the it has high computational cost, the results show that the IDS based on the SVDD-KDE chart produces a high accuracy at 0.917 and AUC at 0.915 with a low false positive rate compared to several algorithms.
format Article
author Muhammad Ahsan, Muhammad Ahsan
Hidayatul Khusna, Hidayatul Khusna
Wibawati, Wibawati
Lee, Muhammad Hisyam
author_facet Muhammad Ahsan, Muhammad Ahsan
Hidayatul Khusna, Hidayatul Khusna
Wibawati, Wibawati
Lee, Muhammad Hisyam
author_sort Muhammad Ahsan, Muhammad Ahsan
title Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring
title_short Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring
title_full Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring
title_fullStr Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring
title_full_unstemmed Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring
title_sort support vector data description with kernel density estimation (svdd-kde) control chart for network intrusion monitoring
publisher Springer Nature
publishDate 2023
url http://eprints.utm.my/106889/1/MuhammadHisyamLee2023_SupportVectorDataDescriptionwithKernel.pdf
http://eprints.utm.my/106889/
http://dx.doi.org/10.1038/s41598-023-46719-3
_version_ 1806442423086219264
score 13.211869

Similar Items