Daily Arxiv

This is a page that curates AI-related papers published worldwide.
All content here is summarized using Google Gemini and operated on a non-profit basis.
Copyright for each paper belongs to the authors and their institutions; please make sure to credit the source when sharing.

Robust Anomaly Detection in Network Traffic: Evaluating Machine Learning Models on CICIDS2017

Created by
  • Haebom

Author

Zhaoyang Xu, Yunbo Liu

Outline

This paper compared and analyzed machine learning models suitable for intrusion detection systems (IDS) using the CICIDS2017 dataset. Four models—a multilayer perceptron (MLP), a one-dimensional convolutional neural network (CNN), an one-class support vector machine (OCSVM), and a local outlier factor (LOF)—were evaluated in two scenarios: detecting existing attacks and generalizing to unknown threats. Supervised learning-based MLP and CNN achieved near-perfect accuracy for existing attacks, but significantly reduced recall for new attacks. Unsupervised learning-based LOF achieved moderate overall accuracy but high recall for unknown threats, but suffered from a high false alarm rate. OCSVM achieved the best balance of precision and recall, demonstrating robust detection performance in both scenarios.

Takeaways, Limitations

•
Takeaways:
◦
We provide practical guidance on selecting an IDS model by comparing the intrusion detection performance of various machine learning models.
◦
Supervised learning models are effective against existing attacks, but show poor generalization ability to new attacks.
◦
Unsupervised learning models are excellent at detecting new attacks, but managing false alarm rates is crucial.
◦
We found that OCSVM is a model that strikes a good balance between detection performance and false alarm rate for new attacks.
•
Limitations:
◦
Since these results are for a specific dataset (CICIDS2017), their generalizability to other datasets is limited.
◦
The analyzed models are limited to four and require comparison with other models.
◦
There may be a lack of consideration for various factors that may occur when applying in a real environment (such as network changes and attack diversity).
👍
Made with Slashpage