The article deals with detection of network anomalies. Network anomalies include everything that is quite different from the normal operation. For detection of anomalies were used machine learning systems. Machine learning can be considered as a support or a limited type of artificial intelligence. A machine learning system usually starts with some knowledge and a corresponding knowledge organization so that it can interpret, analyse, and test the knowledge acquired. There are several machine learning techniques available. We tested Decision tree learning and Bayesian networks. The open source data-mining framework WEKA was the tool we used for testing the classify, cluster, association algorithms and for visualization of our results. The WEKA is a collection of machine learning algorithms for data mining tasks

Bureš, Miroslav

Kapičák, Lukáš

Nevlud, Pavel

Zdrálek, Jaroslav

Advances in Electrical and Electronic Engineering

DSpace at VSB Technical University of Ostrava

INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERAnomaly-based Network Intrusion DetectionMethodsPavel NEVLUD, Miroslav BURES, Lukas KAPICAK, Jaroslav ZDRALEKDepartment of Telecommunications, Faculty of Electrical Engineering and Computer Science,VSB–Technical University of Ostrava, 17. listopadu 15, 708 33 Ostrava-Poruba, Czech Republicpavel.nevlud@vsb.cz, miroslav.bures@vsb.cz, lukas.kapicak@vsb.cz, jaroslav.zdralek@vsb.czAbstract. The article deals with detection of networkanomalies. Network anomalies include everything thatis quite different from the normal operation. For de-tection of anomalies were used machine learning sys-tems. Machine learning can be considered as a supportor a limited type of artificial intelligence. A machinelearning system usually starts with some knowledge anda corresponding knowledge organization so that it caninterpret, analyse, and test the knowledge acquired.There are several machine learning techniques avail-able. We tested Decision tree learning and Bayesiannetworks. The open source data-mining frameworkWEKA was the tool we used for testing the classify,cluster, association algorithms and for visualization ofour results. The WEKA is a collection of machinelearning algorithms for data mining tasks.KeywordsAnomaly-based detection, attack, bayesian net-works, WEKA.1. IntroductionNowadays, computer network is a frequent target ofattacks in order to obtain confidential data, or un-availability of network services. To detect and preventthese attacks, there are a large number of software orhardware solutions such as IDS (Intrusion DetectionSystems), firewalls and monitoring systems.These attacks increased normal network traffic thatappears as something undesirable, what would not oc-cur in the network. Such deviations from normal op-eration are called as network anomalies. Between net-work anomalies include everything that is quite differ-ent from the normal operation of the network [1].Anomalies are values in a statistical sample whichdoes not fit a pattern that describes most other dataFig. 1: A simple example of anomalies.points. Figure 1 illustrates anomalies in a simple 2-dimensional data set. The data has one normal re-gions, since most observations lie in this region. Threepoints that are sufficiently far away from the regionsare anomalies. One of these points is border point thatcan be detected as anomaly.2. Detection of NetworkAnomaliesNetwork anomalies can be detected in several ways.Each method has its advantages and disadvantages,but in practice there are three commonly used meth-ods. Them together they can develop systems such asIDS software.2.1. Comparing SignaturesThe principle of this method is the comparison of net-work data with a database of signatures. Signaturedatabase contains patterns of data anomalies. Dataanomaly pattern is actually a description of a typi-cal data sequence that characterizes the anomaly. Thec© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 468INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERprinciple can be seen in Figure 2. It used the sameprinciple as in the anti-virus programs.Fig. 2: Comparing signatures.The effectiveness of anomaly detection using signa-ture recognition is highly dependent on the quality ofthe database of signatures. The big disadvantage is al-most no detection of new types of attacks called Zeroday attack, because it is not in the database signaturepattern for this type of anomaly [4].2.2. Stateful Protocol AnalysisStateful protocol analysis assumes that each protocolused for network communication is specified, such asRFC. Thanks to precise specifications, all connectionsusing protocols defined state. Each event must occurat the right moment, the state. This makes it possibleto describe the protocol as a state machine. Figure 3illustrates an example of stateful machine.Fig. 3: Stateful protocol analysis.The advantage of this method is less frequent up-dates. The stateful analysis needs update only afterthe change of protocol or the installation of a new one[3].2.3. Behavioral AnalysisThe method of behavioral analysis is based on the as-sumption that the emergence of anomalies can be de-tected by the deviation from the normal or expectednetwork behavior. Model of normally or anticipatedbehavior of the network is created based on networkmonitoring and collecting reference information.The reference information is compiled model normalbehavior and network traffic is subsequently comparedwith this model. Any deviation from such a learnedmodel is automatically considered an anomaly. Theprinciple can be seen in Fig. 4. For behavioral analysisand create network’s model can be used MLS (MachineLearning Systems).Fig. 4: Behavioral analysis.The disadvantage of this method is precisely the finedetection. Any deviation from the normal model isdetected even though it is not an attack or threat. Itis due to the fact that the creation of the model cannot capture all types of network traffic and user activityon the network. This model is created to some extentdistorted.On the other hand, behavioral analysis provides anadvantage in terms of detection of completely newtypes of threats, for example, by comparing detectionsignatures did not react at all.3. Machine Learning SystemsIf we want to be able to solve the computer problem,some intelligence is needed. Machine learning can beconsidered as a support or a limited type of artificialintelligence. Algorithms MLS can move on with thedevelopment of computers. This means that computersare no longer just a database comparing sets of data.A machine learning system usually starts with someknowledge and a corresponding knowledge organiza-tion so that it can interpret, analyze, and test theknowledge acquired. The principle can be seen inFig. 5.c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 469INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERFig. 5: Principle of machine learning system.Training is the process of making the system able tolearn. It may consist of randomly selected examplesthat include a variety of facts and details includingirrelevant data. The learning techniques can be char-acterized as a search through a space of possible hy-potheses or solutions. Background knowledge can beused to make learning more efficient by reducing thesearch space.The success of machine learning system also de-pends on the algorithms. These algorithms controlthe search to find and build the knowledge structures.The algorithms should extract useful information fromtraining examples. There are several machine learningtechniques available [2].Among the best-known machine learningalgorithms include:• Decision tree learning.• Artificial neural networks.• Genetic programming.• Clustering.• Bayesian networks.• Representation learning.4. Decision Tree LearningDecision tree learning is ‘a method for approximatingdiscrete valued functions that is robust to noisy dataand capable of learning disjunctive expressions’ accord-ing to [5].Ross Quinlan has produced several working decisiontree induction methods that have been implemented inhis programs, ID3, C4.5 and C5. Decision tree induc-tion takes a set of known data and induces a decisiontree from that data. The tree can then be used as a ruleset for predicting the outcome from known attributes.The initial data set from which the tree is induced isknown as the training set. The decision tree takes thetop-down form. At the top is the first attribute andits values, from this next branch leads to either an at-tribute or an outcome. Every possible leaf of the treeeventually leads to an outcome.4.1. Decision Trees – C4.5C4.5 is an algorithm developed by Ross Quinlan thatgenerates Decision Trees (DT), which can be used forclassification problems. It improves (extends) the ID3algorithm by dealing with both continuous and dis-crete attributes, missing values and pruning trees afterconstruction. Its commercial successor is C5.0/See5, alot faster that C4.5, more memory efficient and usedfor building smaller decision trees. J48 is an opensource Java implementation of the C4.5 algorithm inthe WEKA data mining tool.Algorithm 1 C4.5(D)Input: an attribute-valued dataset D1: Tree = {}2: if D is ”pure” OR other stopping criteria met then3: terminate4: end if5: for all atribute a ∈ D do6: Compute information-theoretic criteria if we split a7: end for8: abest = Best attribute according to above computed criteria9: Tree = Create a decision node that tests abest in the root10: Dv = Induced sub-datasets from D based on abest11: for all Dv do12: Treev = C4.5(Dv)13: Attache Treev to the corresponding branch of Tree14: end for15: return TreeThe generic description of how C4.5 works is shownin Algorithm 1. A decision tree is built top-down froma root node and involves partitioning the data intosubsets that contain instances with similar values (ho-mogenous). Decision tree algorithm uses entropy tocalculate the homogeneity of a sample. If the sampleis completely homogeneous the entropy is zero and ifthe sample is an equally divided it has entropy of one.The entropy of class random variable that takes on cvalues with probabilities p1, p2, . . . , pc is given by:Entropy(S) =c∑i=1−pi log2 pi. (1)Figure 6 shows the form of the entropy function rel-ative to a binary classification.Fig. 6: Entropy function.c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 470INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBER(a) pingsweep (b) portsweepFig. 7: J48 classifier results.(a) pingsweep (b) portsweepFig. 8: BayesNet classifier results.The estimation criterion in the decision tree algo-rithm is the selection of an attribute to test at eachdecision node in the tree. The goal is to select theattribute that is most useful for classifying examples.A good quantitative measure of the worth of an at-tribute is a statistical property called information gainthat measures how well a given attribute separates thetraining examples according to their target classifica-tion. This measure is used to select among the can-didate attributes at each step while growing the tree.The information gain is based on the decrease in en-tropy after a dataset is split on an attribute. Con-structing a decision tree is all about finding attributethat returns the highest information gain (i.e. the mosthomogeneous branches).Gain(S,A) = Entropy(S)−∑v∈V alues(A)|Sv ||S| Entropy(Sv), (2)where V alues(A) is the set of all possible values for at-tribute A, and Sv is the subset of S for which attributeA has value v (i.e. Sv = {s Iˆ S|A(s) = v}).The first term in the equation for information gainis just the entropy of the original collection S and thesecond term is the expected value of the entropy after Sis partitioned using attribute A. The expected entropydescribed by this second term is simply the sum of theentropies of each subset Sv, weighted by the fractionof examples |Sv|/|S| that belong to Sv. Gain(S,A) istherefore the expected reduction in entropy caused byknowing the value of attribute A. Put another way,Gain(S,A) is the information provided about the tar-get attribute value, given the value of some other at-tribute A. The value of Gain(S,A) is the number ofbits saved when encoding the target value of an arbi-trary member of S, by knowing the value of attributeA.5. Bayesian NetworksBayesian networks are graphical representation of therelationship between variables. Graphical representa-c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 471INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERtion of Bayesian networks are directed acyclic graphswith nodes and edges. Nodes represent variables, pa-rameters or hypotheses and edges represent conditionaldependencies.5.1. Algorithm of Naive BayesianThe Naive Bayesian classifier is based on Bayes’ the-orem with independence assumptions between predic-tors. Bayes theorem provides a way of calculating theposterior probability, P (c|x), from P (c), P (x), andP (x|c). Naive Bayes classifier assumes that the effectof the value of a predictor (x) on a given class (c) isindependent of the values of other predictors. This as-sumption is called class conditional independence.P (c|x) = P (x|c)P (c)P (x), (3)P (c|x) = P (x1|c)×P (x2|c)×· · ·×P (xn|c)×P (c), (4)where P (c|x) is the posterior probability of class (tar-get) given predictor (attribute), P (c) is the prior prob-ability of class, P (x|c) is the likelihood which is theprobability of predictor given class and P (x) is theprior probability of predictor.6. Experimental ResultsFor data mining platform was chosen open sourceproject WEKA [6]. WEKA is a collection of machineFig. 9: Visualize results of pingsweep.learning algorithms for data mining tasks. The algo-rithms can either be applied directly to a dataset orcalled from your own Java code.WEKA contains tools for data pre-processing, clas-sification, regression, clustering, association rules, andvisualization. It is also well-suited for developing newmachine learning schemes.Tested activities were captured by the network trafficcollector and saved as pcap files. These pcap files arebinary files and can’t be read directly into most datamining applications.These pcap files were converted into csv files withscripts using tshark [7]. WEKA accepts *.csv files,*.arff files or a connection to a database. For this re-search were used converted csv files that was openedin WEKA.As part of the preprocessing step, information datawere injected into the data which were useful for train-ing of the data mining algorithm. Additionally insignif-icant data were eliminated if it were not serving theoverall process. To begin running this data throughthe algorithms it was opened in WEKA explorer. Forthe purpose of these initial runs we selected all of theattributes.Fig. 10: Visualize results of portsweep.Figure 7(a) shows the results in WEKA of a J48Classifier training run on data acquired during pingsweep of the target network. The results describedhere were derived from single nmap target scan, wherean attack computer scanned a victim network, probingfor active IP addresses.Also Fig. 7(b) shows the results in WEKA of a J48Classifier training run on data acquired during portc© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 472INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERsweep of the target computer. The results describedhere were derived from single nmap target scan, wherean attack computer scanned a victim computer, prob-ing for open ports.There were chosen only 3 attributes to visualize ex-perimental results. These attributes were IP sourceaddress, IP destination address and Protocol. Figure 9and Fig. 10 show relation between these attributes.Figure 8(a) shows the results in WEKA of a Naive-Bayes Classifier training run on data acquired duringping sweep of the target network. Also Fig. 8(b) showsthe results in WEKA of a NaiveBayes Classifier train-ing run on data acquired during port sweep of the tar-get computer.7. Conclusion and FutureWorkIn this paper, we have presented detection of networkanomalies by using machine learning systems. Machinelearning system usually starts with some knowledgeand during the rounds can improve its knowledge.There were tested some attacks in regular networktraffic. As the first attack was used ping sweep to subnetwork target to get information about active IP ad-dresses. The port sweep was used as second attack toscanning open ports at the target victim computer.First, we captured network traffic by the networkcollector and saved data as pcap format file. Next, weconverted collected data from pcap file into csv for-mat file. We used some scripts by means of tshark toconvert data from pcap to csv file format. Next con-verted csv data was inserted in the WEKA software touse classification of data. Finally classified data wasvisualize by WEKA software.Future work expects to use more attributes that willbe get from pcap files. We also assume the use ofother classification methods and other data mining al-gorithms.AcknowledgmentThe research leading to these results has received fund-ing from the European Community’s Seventh Frame-work Programme (FP7/2007-2013) under grant agree-ment no. 218086.References[1] FOWLER, Ch. A. and R. J. HAMMELL II. Build-ing Baseline Preprocessed Common Data Sets forMultiple Follow-on Data Mining Algorithms. In:Proceedings of the Conference on Information Sys-tems Applied Research 2012. New Orleans: ED-SIG, 2012, pp. 1–17. ISSN 2167-1508.[2] FARRAPOSO, F., P OWEZARSKI and E.MONTEIRO. NADA–Network Anomaly Detec-tion Algorithm. In: 18th IFIP/IEEE Interna-tional Workshop on Distributed Systems: Oper-ations and Management, DSOM 2007. San Jose:Springer Verlag, 2007, vol. 4785, pp 191—194,ISBN 978-3-540-75694-1.[3] DAS, K. Protocol Anomaly Detection forNetwork-based Intrusion Detection. TheSANS Institute [online]. 2002. Availableat: http://www.sans.org/reading_room/whitepapers/detection/protocol_anomaly_detection_for_networkbased_intrusion_detection_349?show=349.php&cat=detection.[4] RICHARD, M. Intrusion Detection FAQ: Arethere limitations of Intrusion Signatures?.The SANS Institute [online]. 2001. Availableat: http://www.sans.org/resources/idfaq/limitations.php.[5] MITCHELL, Tom M. Machine learning. Boston:McGraw-Hill, 1997. ISBN 00-704-2807-7.[6] WEKA 3. Data Mining Software in Java [online].2013. Available at: http://www.cs.waikato.ac.nz/ml/weka/[7] TShark [online]. 2013. Available at: http://www.wireshark.org/docs/man-pages/tshark.htmlAbout AuthorsPavel NEVLUD received his M.Sc. degree intelecommunication engineering from VSB–TechnicalUniversity of Ostrava, Czech Republic in 1995. Sincethis year he has been holding position as an assistantprofessor at the Department of Telecommunications,VSB–Technical University of Ostrava. The topics ofhis research interests are communication technologies,networking and security.Miroslav BURES received his M.Sc. degree intelecommunications from VSB–Technical Universityof Ostrava, Czech Republic in 2011. Since 2011 hasbeen studying Ph.D. degree at the same university.His research is focused on networking, analysis ofnetwork’s data and security.c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 473INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERLukas KAPICAK received his M.Sc. degreein telecommunications from VSB–Technical Universityof Ostrava, Czech Republic in 2007. Since 2007 hasbeen studying Ph.D. degree at the same university.His research is focused on wireless transmission anddata flow analysis, simulation and optimization.Jaroslav ZDRALEK holds position asan associate professor with Departmentof Telecommunications, VSB–Technical Universityof Ostrava, Czech Republic. He received his M.Sc.degree in Computer Science from Slovak TechnicalUniversity of Bratislava, Slovakia in 1977. He receivedhis Ph.D. degree from VSB–Technical Universityof Ostrava in 2002, dissertation thesis ”Diagnosticsystem without dismantling of locomotive controller”.His research is focused on fault tolerant system andcommunication technologies.c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 474

Anomaly-based network intrusion detection
methods

Pavel Nevlud

Miroslav Bures

Lukas Kapicak

Jaroslav Zdralek

Directory of Open Access Journals

INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERAnomaly-based Network Intrusion DetectionMethodsPavel NEVLUD, Miroslav BURES, Lukas KAPICAK, Jaroslav ZDRALEKDepartment of Telecommunications, Faculty of Electrical Engineering and Computer Science,VSB–Technical University of Ostrava, 17. listopadu 15, 708 33 Ostrava-Poruba, Czech Republicpavel.nevlud@vsb.cz, miroslav.bures@vsb.cz, lukas.kapicak@vsb.cz, jaroslav.zdralek@vsb.czAbstract. The article deals with detection of networkanomalies. Network anomalies include everything thatis quite different from the normal operation. For de-tection of anomalies were used machine learning sys-tems. Machine learning can be considered as a supportor a limited type of artificial intelligence. A machinelearning system usually starts with some knowledge anda corresponding knowledge organization so that it caninterpret, analyse, and test the knowledge acquired.There are several machine learning techniques avail-able. We tested Decision tree learning and Bayesiannetworks. The open source data-mining frameworkWEKA was the tool we used for testing the classify,cluster, association algorithms and for visualization ofour results. The WEKA is a collection of machinelearning algorithms for data mining tasks.KeywordsAnomaly-based detection, attack, bayesian net-works, WEKA.1. IntroductionNowadays, computer network is a frequent target ofattacks in order to obtain confidential data, or un-availability of network services. To detect and preventthese attacks, there are a large number of software orhardware solutions such as IDS (Intrusion DetectionSystems), firewalls and monitoring systems.These attacks increased normal network traffic thatappears as something undesirable, what would not oc-cur in the network. Such deviations from normal op-eration are called as network anomalies. Between net-work anomalies include everything that is quite differ-ent from the normal operation of the network [1].Anomalies are values in a statistical sample whichdoes not fit a pattern that describes most other dataFig. 1: A simple example of anomalies.points. Figure 1 illustrates anomalies in a simple 2-dimensional data set. The data has one normal re-gions, since most observations lie in this region. Threepoints that are sufficiently far away from the regionsare anomalies. One of these points is border point thatcan be detected as anomaly.2. Detection of NetworkAnomaliesNetwork anomalies can be detected in several ways.Each method has its advantages and disadvantages,but in practice there are three commonly used meth-ods. Them together they can develop systems such asIDS software.2.1. Comparing SignaturesThe principle of this method is the comparison of net-work data with a database of signatures. Signaturedatabase contains patterns of data anomalies. Dataanomaly pattern is actually a description of a typi-cal data sequence that characterizes the anomaly. Thec© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 468INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERprinciple can be seen in Figure 2. It used the sameprinciple as in the anti-virus programs.Fig. 2: Comparing signatures.The effectiveness of anomaly detection using signa-ture recognition is highly dependent on the quality ofthe database of signatures. The big disadvantage is al-most no detection of new types of attacks called Zeroday attack, because it is not in the database signaturepattern for this type of anomaly [4].2.2. Stateful Protocol AnalysisStateful protocol analysis assumes that each protocolused for network communication is specified, such asRFC. Thanks to precise specifications, all connectionsusing protocols defined state. Each event must occurat the right moment, the state. This makes it possibleto describe the protocol as a state machine. Figure 3illustrates an example of stateful machine.Fig. 3: Stateful protocol analysis.The advantage of this method is less frequent up-dates. The stateful analysis needs update only afterthe change of protocol or the installation of a new one[3].2.3. Behavioral AnalysisThe method of behavioral analysis is based on the as-sumption that the emergence of anomalies can be de-tected by the deviation from the normal or expectednetwork behavior. Model of normally or anticipatedbehavior of the network is created based on networkmonitoring and collecting reference information.The reference information is compiled model normalbehavior and network traffic is subsequently comparedwith this model. Any deviation from such a learnedmodel is automatically considered an anomaly. Theprinciple can be seen in Fig. 4. For behavioral analysisand create network’s model can be used MLS (MachineLearning Systems).Fig. 4: Behavioral analysis.The disadvantage of this method is precisely the finedetection. Any deviation from the normal model isdetected even though it is not an attack or threat. Itis due to the fact that the creation of the model cannot capture all types of network traffic and user activityon the network. This model is created to some extentdistorted.On the other hand, behavioral analysis provides anadvantage in terms of detection of completely newtypes of threats, for example, by comparing detectionsignatures did not react at all.3. Machine Learning SystemsIf we want to be able to solve the computer problem,some intelligence is needed. Machine learning can beconsidered as a support or a limited type of artificialintelligence. Algorithms MLS can move on with thedevelopment of computers. This means that computersare no longer just a database comparing sets of data.A machine learning system usually starts with someknowledge and a corresponding knowledge organiza-tion so that it can interpret, analyze, and test theknowledge acquired. The principle can be seen inFig. 5.c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 469INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERFig. 5: Principle of machine learning system.Training is the process of making the system able tolearn. It may consist of randomly selected examplesthat include a variety of facts and details includingirrelevant data. The learning techniques can be char-acterized as a search through a space of possible hy-potheses or solutions. Background knowledge can beused to make learning more efficient by reducing thesearch space.The success of machine learning system also de-pends on the algorithms. These algorithms controlthe search to find and build the knowledge structures.The algorithms should extract useful information fromtraining examples. There are several machine learningtechniques available [2].Among the best-known machine learningalgorithms include:• Decision tree learning.• Artificial neural networks.• Genetic programming.• Clustering.• Bayesian networks.• Representation learning.4. Decision Tree LearningDecision tree learning is ‘a method for approximatingdiscrete valued functions that is robust to noisy dataand capable of learning disjunctive expressions’ accord-ing to [5].Ross Quinlan has produced several working decisiontree induction methods that have been implemented inhis programs, ID3, C4.5 and C5. Decision tree induc-tion takes a set of known data and induces a decisiontree from that data. The tree can then be used as a ruleset for predicting the outcome from known attributes.The initial data set from which the tree is induced isknown as the training set. The decision tree takes thetop-down form. At the top is the first attribute andits values, from this next branch leads to either an at-tribute or an outcome. Every possible leaf of the treeeventually leads to an outcome.4.1. Decision Trees – C4.5C4.5 is an algorithm developed by Ross Quinlan thatgenerates Decision Trees (DT), which can be used forclassification problems. It improves (extends) the ID3algorithm by dealing with both continuous and dis-crete attributes, missing values and pruning trees afterconstruction. Its commercial successor is C5.0/See5, alot faster that C4.5, more memory efficient and usedfor building smaller decision trees. J48 is an opensource Java implementation of the C4.5 algorithm inthe WEKA data mining tool.Algorithm 1 C4.5(D)Input: an attribute-valued dataset D1: Tree = {}2: if D is ”pure” OR other stopping criteria met then3: terminate4: end if5: for all atribute a ∈ D do6: Compute information-theoretic criteria if we split a7: end for8: abest = Best attribute according to above computed criteria9: Tree = Create a decision node that tests abest in the root10: Dv = Induced sub-datasets from D based on abest11: for all Dv do12: Treev = C4.5(Dv)13: Attache Treev to the corresponding branch of Tree14: end for15: return TreeThe generic description of how C4.5 works is shownin Algorithm 1. A decision tree is built top-down froma root node and involves partitioning the data intosubsets that contain instances with similar values (ho-mogenous). Decision tree algorithm uses entropy tocalculate the homogeneity of a sample. If the sampleis completely homogeneous the entropy is zero and ifthe sample is an equally divided it has entropy of one.The entropy of class random variable that takes on cvalues with probabilities p1, p2, . . . , pc is given by:Entropy(S) =c∑i=1−pi log2 pi. (1)Figure 6 shows the form of the entropy function rel-ative to a binary classification.Fig. 6: Entropy function.c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 470INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBER(a) pingsweep (b) portsweepFig. 7: J48 classifier results.(a) pingsweep (b) portsweepFig. 8: BayesNet classifier results.The estimation criterion in the decision tree algo-rithm is the selection of an attribute to test at eachdecision node in the tree. The goal is to select theattribute that is most useful for classifying examples.A good quantitative measure of the worth of an at-tribute is a statistical property called information gainthat measures how well a given attribute separates thetraining examples according to their target classifica-tion. This measure is used to select among the can-didate attributes at each step while growing the tree.The information gain is based on the decrease in en-tropy after a dataset is split on an attribute. Con-structing a decision tree is all about finding attributethat returns the highest information gain (i.e. the mosthomogeneous branches).Gain(S,A) = Entropy(S)−∑v∈V alues(A)|Sv ||S|Entropy(Sv), (2)where V alues(A) is the set of all possible values for at-tribute A, and Sv is the subset of S for which attributeA has value v (i.e. Sv = {s Î S|A(s) = v}).The first term in the equation for information gainis just the entropy of the original collection S and thesecond term is the expected value of the entropy after Sis partitioned using attribute A. The expected entropydescribed by this second term is simply the sum of theentropies of each subset Sv, weighted by the fractionof examples |Sv|/|S| that belong to Sv. Gain(S,A) istherefore the expected reduction in entropy caused byknowing the value of attribute A. Put another way,Gain(S,A) is the information provided about the tar-get attribute value, given the value of some other at-tribute A. The value of Gain(S,A) is the number ofbits saved when encoding the target value of an arbi-trary member of S, by knowing the value of attributeA.5. Bayesian NetworksBayesian networks are graphical representation of therelationship between variables. Graphical representa-c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 471INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERtion of Bayesian networks are directed acyclic graphswith nodes and edges. Nodes represent variables, pa-rameters or hypotheses and edges represent conditionaldependencies.5.1. Algorithm of Naive BayesianThe Naive Bayesian classifier is based on Bayes’ the-orem with independence assumptions between predic-tors. Bayes theorem provides a way of calculating theposterior probability, P (c|x), from P (c), P (x), andP (x|c). Naive Bayes classifier assumes that the effectof the value of a predictor (x) on a given class (c) isindependent of the values of other predictors. This as-sumption is called class conditional independence.P (c|x) = P (x|c)P (c)P (x), (3)P (c|x) = P (x1|c)×P (x2|c)×· · ·×P (xn|c)×P (c), (4)where P (c|x) is the posterior probability of class (tar-get) given predictor (attribute), P (c) is the prior prob-ability of class, P (x|c) is the likelihood which is theprobability of predictor given class and P (x) is theprior probability of predictor.6. Experimental ResultsFor data mining platform was chosen open sourceproject WEKA [6]. WEKA is a collection of machineFig. 9: Visualize results of pingsweep.learning algorithms for data mining tasks. The algo-rithms can either be applied directly to a dataset orcalled from your own Java code.WEKA contains tools for data pre-processing, clas-sification, regression, clustering, association rules, andvisualization. It is also well-suited for developing newmachine learning schemes.Tested activities were captured by the network trafficcollector and saved as pcap files. These pcap files arebinary files and can’t be read directly into most datamining applications.These pcap files were converted into csv files withscripts using tshark [7]. WEKA accepts *.csv files,*.arff files or a connection to a database. For this re-search were used converted csv files that was openedin WEKA.As part of the preprocessing step, information datawere injected into the data which were useful for train-ing of the data mining algorithm. Additionally insignif-icant data were eliminated if it were not serving theoverall process. To begin running this data throughthe algorithms it was opened in WEKA explorer. Forthe purpose of these initial runs we selected all of theattributes.Fig. 10: Visualize results of portsweep.Figure 7(a) shows the results in WEKA of a J48Classifier training run on data acquired during pingsweep of the target network. The results describedhere were derived from single nmap target scan, wherean attack computer scanned a victim network, probingfor active IP addresses.Also Fig. 7(b) shows the results in WEKA of a J48Classifier training run on data acquired during portc© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 472INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERsweep of the target computer. The results describedhere were derived from single nmap target scan, wherean attack computer scanned a victim computer, prob-ing for open ports.There were chosen only 3 attributes to visualize ex-perimental results. These attributes were IP sourceaddress, IP destination address and Protocol. Figure 9and Fig. 10 show relation between these attributes.Figure 8(a) shows the results in WEKA of a Naive-Bayes Classifier training run on data acquired duringping sweep of the target network. Also Fig. 8(b) showsthe results in WEKA of a NaiveBayes Classifier train-ing run on data acquired during port sweep of the tar-get computer.7. Conclusion and FutureWorkIn this paper, we have presented detection of networkanomalies by using machine learning systems. Machinelearning system usually starts with some knowledgeand during the rounds can improve its knowledge.There were tested some attacks in regular networktraffic. As the first attack was used ping sweep to subnetwork target to get information about active IP ad-dresses. The port sweep was used as second attack toscanning open ports at the target victim computer.First, we captured network traffic by the networkcollector and saved data as pcap format file. Next, weconverted collected data from pcap file into csv for-mat file. We used some scripts by means of tshark toconvert data from pcap to csv file format. Next con-verted csv data was inserted in the WEKA software touse classification of data. Finally classified data wasvisualize by WEKA software.Future work expects to use more attributes that willbe get from pcap files. We also assume the use ofother classification methods and other data mining al-gorithms.AcknowledgmentThe research leading to these results has received fund-ing from the European Community’s Seventh Frame-work Programme (FP7/2007-2013) under grant agree-ment no. 218086.References[1] FOWLER, Ch. A. and R. J. HAMMELL II. Build-ing Baseline Preprocessed Common Data Sets forMultiple Follow-on Data Mining Algorithms. In:Proceedings of the Conference on Information Sys-tems Applied Research 2012. New Orleans: ED-SIG, 2012, pp. 1–17. ISSN 2167-1508.[2] FARRAPOSO, F., P OWEZARSKI and E.MONTEIRO. NADA–Network Anomaly Detec-tion Algorithm. In: 18th IFIP/IEEE Interna-tional Workshop on Distributed Systems: Oper-ations and Management, DSOM 2007. San Jose:Springer Verlag, 2007, vol. 4785, pp 191—194,ISBN 978-3-540-75694-1.[3] DAS, K. Protocol Anomaly Detection forNetwork-based Intrusion Detection. TheSANS Institute [online]. 2002. Availableat: http://www.sans.org/reading_room/whitepapers/detection/protocol_anomaly_detection_for_networkbased_intrusion_detection_349?show=349.php&cat=detection.[4] RICHARD, M. Intrusion Detection FAQ: Arethere limitations of Intrusion Signatures?.The SANS Institute [online]. 2001. Availableat: http://www.sans.org/resources/idfaq/limitations.php.[5] MITCHELL, Tom M. Machine learning. Boston:McGraw-Hill, 1997. ISBN 00-704-2807-7.[6] WEKA 3. Data Mining Software in Java [online].2013. Available at: http://www.cs.waikato.ac.nz/ml/weka/[7] TShark [online]. 2013. Available at: http://www.wireshark.org/docs/man-pages/tshark.htmlAbout AuthorsPavel NEVLUD received his M.Sc. degree intelecommunication engineering from VSB–TechnicalUniversity of Ostrava, Czech Republic in 1995. Sincethis year he has been holding position as an assistantprofessor at the Department of Telecommunications,VSB–Technical University of Ostrava. The topics ofhis research interests are communication technologies,networking and security.Miroslav BURES received his M.Sc. degree intelecommunications from VSB–Technical Universityof Ostrava, Czech Republic in 2011. Since 2011 hasbeen studying Ph.D. degree at the same university.His research is focused on networking, analysis ofnetwork’s data and security.c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 473INFORMATION AND COMMUNICATION TECHNOLOGIES AND SERVICES VOLUME: 11 | NUMBER: 6 | 2013 | DECEMBERLukas KAPICAK received his M.Sc. degreein telecommunications from VSB–Technical Universityof Ostrava, Czech Republic in 2007. Since 2007 hasbeen studying Ph.D. degree at the same university.His research is focused on wireless transmission anddata flow analysis, simulation and optimization.Jaroslav ZDRALEK holds position asan associate professor with Departmentof Telecommunications, VSB–Technical Universityof Ostrava, Czech Republic. He received his M.Sc.degree in Computer Science from Slovak TechnicalUniversity of Bratislava, Slovakia in 1977. He receivedhis Ph.D. degree from VSB–Technical Universityof Ostrava in 2002, dissertation thesis ”Diagnosticsystem without dismantling of locomotive controller”.His research is focused on fault tolerant system andcommunication technologies.c© 2013 ADVANCES IN ELECTRICAL AND ELECTRONIC ENGINEERING 474

Anomaly-based Network Intrusion Detection Methods

http://doaj.org/search?source=%7B%22query%22%3A%7B%22bool%22%3A%7B%22must%22%3A%5B%7B%22term%22%3A%7B%22id%22%3A%220d98e01804564d6aa1393744e4587bf0%22%7D%7D%5D%7D%7D%7D

Anomaly-based network intrusion detection methods

Abstract

Similar works

Full text

Available Versions

DSpace at VSB Technical University of Ostrava

Directory of Open Access Journals