Journal Article

A two-stage flow-based intrusion detection model for next-generation networks

Umer, Muhammad Fahad, Sher, Muhammad, Bi, Yaxin

2018

Overview

The next-generation network provides state-of-the-art access-independent services over converged mobile and fixed networks. Security in the converged network environment is a major challenge. Traditional packet and protocol-based intrusion detection techniques cannot be used in next-generation networks due to slow throughput, low accuracy and their inability to inspect encrypted payload. An alternative solution for protection of next-generation networks is to use network flow records for detection of malicious activity in the network traffic. The network flow records are independent of access networks and user applications. In this paper, we propose a two-stage flow-based intrusion detection system for next-generation networks. The first stage uses an enhanced unsupervised one-class support vector machine which separates malicious flows from normal network traffic. The second stage uses a self-organizing map which automatically groups malicious flows into different alert clusters. We validated the proposed approach on two flow-based datasets and obtained promising results.

• Publisher: Public Library of Science,Public Library of Science (PLoS)
• Subject: Architectural engineering / Biology and Life Sciences / Classification / Communication / Communications traffic / Computer and Information Sciences / Computer networks / Computer science / Convergence / Flow / International conferences / Intrusion / Intrusion detection systems / Multimedia / Network security software / Neural networks / Physical Sciences / Protocol / Security / Security management / Self organizing maps / Social Sciences / Software engineering / Support vector machines / Traffic congestion / Traffic flow / Wireless networks / Wireless sensor networks