VTechWorks staff will be away for the winter holidays starting Tuesday, December 24, 2024, through Wednesday, January 1, 2025, and will not be replying to requests during this time. Thank you for your patience, and happy holidays!
 

Embedding Network Information for Machine Learning-based Intrusion Detection

Simple item page
dc.contributor.authorDeFreeuw, Jonathan Danielen
dc.contributor.committeechairTront, Joseph G.en
dc.contributor.committeememberYang, Yalingen
dc.contributor.committeememberMarchany, Randolph C.en
dc.contributor.departmentElectrical and Computer Engineeringen
dc.date.accessioned2020-07-12T06:00:55Zen
dc.date.available2020-07-12T06:00:55Zen
dc.date.issued2019-01-18en
dc.description.abstractAs computer networks grow and demonstrate more complicated and intricate behaviors, traditional intrusion detections systems have fallen behind in their ability to protect network resources. Machine learning has stepped to the forefront of intrusion detection research due to its potential to predict future behaviors. However, training these systems requires network data such as NetFlow that contains information regarding relationships between hosts, but requires human understanding to extract. Additionally, standard methods of encoding this categorical data struggles to capture similarities between points. To counteract this, we evaluate a method of embedding IP addresses and transport-layer ports into a continuous space, called IP2Vec. We demonstrate this embedding on two separate datasets, CTU'13 and UGR'16, and combine the UGR'16 embedding with several machine learning methods. We compare the models with and without the embedding to evaluate the benefits of including network behavior into an intrusion detection system. We show that the addition of embeddings improve the F1-scores for all models in the multiclassification problem given in the UGR'16 data.en
dc.description.abstractgeneralAs computer networks grow and demonstrate more complicated and intricate behaviors, traditional network protection tools like firewalls struggle to protect personal computers and servers. Machine learning has stepped to the forefront to counteract this by learning and predicting behavior on a network. However, this learned behavior fails to capture much of the information regarding relationships between computers on a network. Additionally, standard techniques to convert network information into numbers struggles to capture many of the similarities between machines. To counteract this, we evaluate a method to capture relationships between IP addresses and ports, called an embedding. We demonstrate this embedding on two different datasets of network traffic, and evaluate the embedding on one dataset with several machine learning methods. We compare the models with and without the embedding to evaluate the benefits of including network behavior into an intrusion detection system. We show that including network behavior into machine learning models improves the performance of classifying attacks found in the UGR’16 data.en
dc.description.degreeMSen
dc.format.mediumETDen
dc.identifier.othervt_gsexam:18767en
dc.identifier.urihttp://hdl.handle.net/10919/99342en
dc.publisherVirginia Techen
dc.rightsIn Copyrighten
dc.rights.urihttp://rightsstatements.org/vocab/InC/1.0/en
dc.subjectword embeddingsen
dc.subjectintrusion detectionen
dc.titleEmbedding Network Information for Machine Learning-based Intrusion Detectionen
dc.typeThesisen
thesis.degree.disciplineComputer Engineeringen
thesis.degree.grantorVirginia Polytechnic Institute and State Universityen
thesis.degree.levelmastersen
thesis.degree.nameMSen

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
DeFreeuw_JD_T_2019.pdf
Size:
1.33 MB
Format:
Adobe Portable Document Format
Download

Collections

Masters Theses