Data Mining Practical Machine Learning Tools and Techniques

Botnet is regarded as one of the most sophisticated vulnerability threats nowadays. A large portion of network traffic is dominated by Botnets. Botnets are conglomeration of trade PCs (Bots) which are remotely controlled by their originator (BotMaster) under a Command and-Control (C&C) foundation. They are the keys to several Internet assaults like spams, Distributed Denial of Service Attacks (DDoS), rebate distortions, malwares and phishing. To over the problem of DDoS attack, various machine learning methods typically Support Vector Machine (SVM), Artificial Neural Network (ANN), Naive Bayes (NB), Decision Tree (DT), and Unsupervised Learning (USML) (K-means, X-means etc.) were proposed. With the increasing popularity of Machine Learning in the field of Computer Security, it will be a remarkable accomplishment to carry out performance assessment of the machine learning methods given a common platform. This could assist developers in choosing a suitable method for their case studies and assist them in further research. This paper performed an experimental analysis of the machine learning methods for Botnet DDoS attack detection. The evaluation is done on the UNBS-NB 15 and KDD99 which are well-known publicity datasets for Botnet DDoS attack detection. Machine learning methods typically Support Vector Machine (SVM), Artificial Neural Network (ANN), Naive Bayes (NB), Decision Tree (DT), and Unsupervised Learning (USML) are investigated for Accuracy, False Alarm Rate (FAR), Sensitivity, Specificity, False positive rate (FPR), AUC, and Matthews correlation coefficient (MCC) of datasets. Performance of KDD99 dataset has been experimentally shown to be better as compared to the UNBS-NB 15 dataset. This validation is significant in computer security and other related fields.

Performance evaluation of Botnet DDoS attack detection using machine learning

Security assurance in Vehicular Ad hoc Network (VANET) is a crucial and challenging task due to the open-access medium. One great threat to VANETs is Distributed Denial-of-Service (DDoS) attack because the target of this attack is to prevent authorized nodes from accessing the services. To provide high availability of VANETs, a scalable, reliable and robust network intrusion detection system should be developed to efficiently mitigate DDoS. However, big data from VANETs poses serious challenges to DDoS attack detection since the detection system require scalable methods to capture, store and process the big data. To overcome these challenges, this paper proposes a distributed DDoS network intrusion detection system based on big data technology. The proposed detection system consists of two main components: real-time network traffic collection module and network traffic detection module. To build our proposed system, we use Spark to speed up data processing and use HDFS to store massive suspicious attacks. In the network collection module, micro-batch data processing model is used to improve the real-time performance of traffic feature collection. In the traffic detection module, the classification algorithm based on Random Forest (RF) is adopted. In order to evaluate the accuracy of detection, the algorithm was evaluated and compared in the datasets, containing NSL-KDD and UNSW-NB15. The experimental results show that the proposed detection algorithm reached the accuracy rate of 99.95% and 98.75%, and the false alarm rate (FAR) of 0.05% and 1.08%, respectively, in two datasets.

/pdf/a-distributed-network-intrusion-detection-system-for-1kk1yolg88.pdf

A Distributed Network Intrusion Detection System for Distributed Denial of Service Attacks in Vehicular Ad Hoc Network

Cloud computing (CC) is on-demand accessibility of network resources, especially data storage and processing power, without special and direct management by the users. CC recently has emerged as a set of public and private datacenters that offers the client a single platform across the Internet. Edge computing is an evolving computing paradigm that brings computation and information storage nearer to the end-users to improve response times and spare transmission capacity. Mobile CC (MCC) uses distributed computing to convey applications to cell phones. However, CC and edge computing have security challenges, including vulnerability for clients and association acknowledgment, that delay the rapid adoption of computing models. Machine learning (ML) is the investigation of computer algorithms that improve naturally through experience. In this review paper, we present an analysis of CC security threats, issues, and solutions that utilized one or several ML algorithms. We review different ML algorithms that are used to overcome the cloud security issues including supervised, unsupervised, semi-supervised, and reinforcement learning. Then, we compare the performance of each technique based on their features, advantages, and disadvantages. Moreover, we enlist future research directions to secure CC models.

https://www.mdpi.com/2079-9292/9/9/1379/pdf

A Review of Machine Learning Algorithms for Cloud Computing Security

An efficient metaheuristic algorithm based feature selection and recurrent neural network for DoS attack detection in cloud computing environment

Cloud computing is a revolution in IT technology that provides scalable, virtualized on-demand resources to the end users with greater flexibility, less maintenance and reduced infrastructure cost. These resources are supervised by different management organizations and provided over Internet using known networking protocols, standards and formats. The underlying technologies and legacy protocols contain bugs and vulnerabilities that can open doors for intrusion by the attackers. Attacks as DDoS (Distributed Denial of Service) are ones of the most frequent that inflict serious damage and affect the cloud performance. In a DDoS attack, the attacker usually uses innocent compromised computers (called zombies) by taking advantages of known or unknown bugs and vulnerabilities to send a large number of packets from these already-captured zombies to a server. This may occupy a major portion of network bandwidth of the victim cloud infrastructures or consume much of the servers time. Thus, in this work, we designed a DDoS detection system based on the C.4.5 algorithm to mitigate the DDoS threat. This algorithm, coupled with signature detection techniques, generates a decision tree to perform automatic, effective detection of signatures attacks for DDoS flooding attacks. To validate our system, we selected other machine learning techniques and compared the obtained results.

DDoS attack detection using machine learning techniques in cloud computing environments

An important issue of energy efficiency in cloud environment is to perform more jobs while consuming less amount of power. Virtual machine consolidation remains the most deployed strategy to manage both performance and energy consumption. Most of existing energy efficiency techniques save energy against the cost on performance degradation. Consolidation techniques leverage thresholds to detect overloaded and underloaded hosts that could be vacated to achieve optimal balance between host utilization and energy consumption. In this research, we propose an energy-efficient strategy (EES) to consolidate virtual machines in cloud environment with an aim of reducing the energy consumption while completing more tasks with the highest throughput. Our proposal makes use of the performance-to-power ratio to set upper thresholds for overload detection. In addition, EES considers the overall data center workload utilization to set lower thresholds, which can reduce the number of virtual machine migrations. The simulation results show that EES leads to energy-efficient workload consolidation with the minimal number of migrations and less energy consumption. The results conclude that EES saves energy consumption without compromising user’s workload requirement.

Energy-efficient strategy for virtual machine consolidation in cloud environment

Mobile Ad-hoc Network (MANET) is a self-configuring infrastructure less network of mobile devices connected by wireless links. In this network technology, simulative analysis is a significant method to understand the performance of routing protocols. In this paper three protocols AODV, DSDV and DSR were simulated using Manhattan Grid Mobility Model. The reactive (AODV, DSR) and proactive (DSDV) protocol's internal mechanism leads to considerable performance difference. The performance differentials are analyzed using NS-2 which is the main network simulator, NAM (Network Animator), AWK (post processing script) and were compared in terms of Packet Delivery Fraction (PDF), Average end-to- end Delay and Throughput, in different environments specified by varying network load , mobility rate and number of nodes. Our results presented in this research work demonstrate the performance analysis of AODV, DSDV and DSR routing protocols. It has been observed that, under Manhattan Grid mobility model, AODV and DSR performs better than DSDV in terms of PDF and Throughput. However in term of Average end-to-end Delay, DSDV appears to be the best one. KeywordsDSR, DSDV, Performance Parameters, Network Simulator (NS-2), Mobile Ad hoc Network, Manhattan Grid Mobility Model, BONNMOTION.

/pdf/simulation-analysis-of-routing-protocols-using-manhattan-17skyc2slq.pdf

Simulation Analysis of Routing Protocols using Manhattan Grid Mobility Model in MANET

Blind Flooding is the simplest broadcasting operation used in a wireless mesh network (WMN) based IEEE 802.11s. However such mechanism can significantly degrade the network performance due to the considerable amount of broadcast traffic a WMN may face. Actually, routing relies heavily on layer two broadcasting and WMNs may bridge wired networks which deploy many broadcasting based application. In previous work we have designed an adaptive approach to control the forwarding of flooded messages into the mesh. The main focus of our previous simulations was to simulate the flooding process in wireless mesh network routing protocol, namely Hybrid Wireless Mesh Protocol (HWMP), which is using Blind Flooding. Generally, the results have shown a considerable amelioration of the network capacity specially with scaling. In this paper we evaluate our scheme, namely Control of Broadcast Forwarding (CBF), in comparison with Blind Flooding protocol. Our protocol is a self pruning algorithm where each node decides itself if or not to rebroadcast a flooded message based on packet type information element and 2-hop neighborhood knowledge. Simulations results show a significant reduction of broadcast cost while improving slightly the average end to end delay.

CBF evaluation through simulation

In wireless multi-hop networks, broadcasting by flooding generates frequent retransmissions of unnecessary packets that participate heavily in increasing contention and collision probability. These problems become increasingly likely in a wireless mesh network which can interface to other external networks, thus leading to a significant increase in broadcast traffic. In this paper we have focused on IEEE 802.11s based wireless mesh networks and we have designed a new adaptive approach based on self-pruning to control broadcast traffic forwarding. Our algorithm uses two-hop neighbor information to ascertain the forwarding decision. Simulation results show the advantages of our approach which has contributed to significantly reduce unnecessary rebroadcasts while improving average end to end delay, network load and throughput.

Youssef Saadi

Papers

DDoS attack detection using machine learning techniques in cloud computing environments

Energy-efficient strategy for virtual machine consolidation in cloud environment

Simulation Analysis of Routing Protocols using Manhattan Grid Mobility Model in MANET

CBF evaluation through simulation

An adaptive approach to control broadcast traffic in wireless mesh networks based IEEE 802.11s