IRJET- Network Security and Intrusion Detection System using Data Mining Techniques

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 07 Issue: 07 | July 2020

p-ISSN: 2395-0072

www.irjet.net

NETWORK SECURITY AND INTRUSION DETECTION SYSTEM USING DATA MINING TECHNIQUES UMASANKAR .K1, RAJESWARI.P2 1Assistant

Professor, Department of Computer Science. of Philosophy, Department of Computer Science.

1,2PRIST University Kumbakonam Campus, Thanjavur,Tamil Nadu, India ------------------------------------------------------------------------***----------------------------------------------------------------------2Master

Abstract - With the significant increase in the use of computers over the network and the development of applications on

different platforms, the focus is on network security. The identification of multiple attacks is actually an important element of network security. The role of the IDS is to track and prevent unauthorized use or damage to network resources and systems. This paper develops data mining - based model of intrusion detection system on both Network Intrusion Detection to monitor all network traffic passing on segment, where a detector is installed to alert the administrator of any signature based activity or suspicious anomaly, and Host Intrusion Detection to monitor inbound and outbound packets from a network device, and will alert the user or network administrator of suspicious behaviour detected. The model designed addresses negative effects of its weaknesses so as to enhance operational effectiveness. The importance of intrusion detection systems and the old techniques, type, characteristics and limitations would be given special attention in this research.

Keywords: Network Security, Intrusion Detection System, Anomaly Detection, Misuse Detection, Data mining, Clustering, Classifications.

I. INTRODUCTION

the analysis of data is too hard. This give rise to the need of using IDS along with different Data mining techniques for intrusion detection. Lee & Salvatore J. Stolfo, Columbia University were first to apply Data mining techniques in the IDS [3]. Data mining techniques such as classification and clustering easily extract the information from large dataset. The remaining part of the paper is structured in this way. Section I introduction, Section II review the related work on IDS using Data mining techniques, Section III explanation of IDS. In Section IV, Data mining and its techniques which are used in IDS are described and finally Section V brings us to the conclusion.

With the speedy escalation of Internet, there is enhancement in the lifestyle of people but at the cost of threats, which are created by either individuals or any organization. They are used to break the security of network. Security means degree of protection given to the network or system. The main goals of security are confidentiality, Integrity and availability of data [1].

Attacks on network can be referred as Intrusion. Intrusion means any set of malicious activities that attempt to compromise the security goals of the information. In early days, only conventional approaches were used for network such as encryption, firewalls, virtual private network etc but they were not enough to secure network completely. It is difficult to depend completely on static defense techniques. This increases the need for dynamic technique, which can be monitors system and identify illegal activities. Thus to enhance the network security dynamic approach is introduced and known as Intrusion Detection System. Intrusion detection system collects online information from the network after that monitors and analyzes these information and partitions it into normal & malicious activities, provide the result to system administrator [2]. IDS is the area, where Data mining is used extensively, this is due to limited scalability, adaptability and alidity.

TYPES OF ATTACKS A. Dos attack

A denial-of-service attack or distributed denial-of-service attack is an effort to make a computer resource out of stock to its indented users [32].This type of attack slows down the system or shut down the system so it disrupt the service and deny the legitimate authorized user. Due to this attack high network traffic occurs.

B. User to Root Attack (U2R)

In this type of attack, the attacker starts with user level like taking down the password, dictionary attack and finally attacker achieves root to access the system.

In IDS data is collected from various sources like network log data, host data etc. Since the network traffic is large,

Š 2020, IRJET

|

Impact Factor value: 7.529

|

ISO 9001:2008 Certified Journal

|

Page 5639

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 07 Issue: 07 | July 2020

p-ISSN: 2395-0072

www.irjet.net

C. Probing

virus do not function well. Precise and smarter intrusion detection systems (IDSs) are required to solve this problem. Different techniques and strategies to resolve IDS shortcomings such as high false alert rates, poor reliability, and time consuming have been introduced in recent decades. A Hybrid Intrusion Identification (HII) method [19] based on DT and KNN is proposed in this paper. A functional selection method is used to extract structured information from NSL-KDD data set to improve the performance of the proposed approach.

In this type of attack, an attacker examines a network to gather information or discover well-known vulnerabilities.

An attacker who has a record, of which machines and services are accessible on a known network, can make use of this information to look for delicate points.

D. Remote to User Attack (R2U)

In this type of attack, an attacker has the capability to send packet to a machine over a network but does not have an account on that machine, make use of some vulnerability to achieve local access as a user of that machine.

The Intelligent Intrusion Detection system (IIDS), an essential detection measuring to protect data integrity and the network availability of attacks

E. Eavesdropping attack

Eavesdropping is a network layer attack consisting of capturing packets from the network transmitted by others' computers and reading the sensitive information like passwords, session tokens, or any kind of confidential information.

[20], is a requested system based on sophisticated algorithms. It's an intrusion detection combination of software and hardware. An intrusion detection system using Data mining Based Enhanced Framework (DEF) In this article, the design is based on k-mean algorithms and the decision-tab. It is therefore important to determine the number of Ks (cluster number) and total runs (completed runs). Against this context. The DT algorithm was also useful in data mining. To this end, after initial pre-processing of the intended data set, a genetic algorithm (GA) was used in order to improve clustering.

Clusters have been assigned to cluster members as labels It revised and eventually used the dataset in the process of classification. For data identification, the modified data set containing cluster labels is then used. The GA has been used to refine the confidence parameter and therefore to improve the performance of the DT classification system.

The result was presented to the proposal model, which may be utilized in marked and unscripted datasets, i.e. supervised or unsupervised approaches, in view of the implementation in this system of clustering and classification techniques.

F. Man-In-The-Middle Attack

In this the attacker makes independent connections with the victims and relays messages between them and making them believe that they are talking directly to each other over a private connection, but the fact is that the entire conversation is controlled by the attacker.

II. LITERATURE SURVEY Intrusion and attack techniques are now more advanced, with large amounts of network traffic information and complex behavior overcoming conventional intrusion detection (IDS). High detection reliability, high false positives rates and high runtime benefit from the existing cloud IDSs. This paper introduces a distributed intrusion detection architecture focused on machine learning for cloud environments. The proposed system is intended to run alongside the edge network components of the service provider in the cloud. The incoming network traffic can thus interrupt network routers on the physical layer [18].

Used to make the preprocessing of traffic on a cloud router possible by the use of the Sliding Windows Algorithm (SWA) to the Naive Bayes Classification System. This anomaly detection module has a set of Hadoop and MapReduce commodity database nodes which can be used when the congestion in the network increases. Anomaly network traffic data is synchronized to a central storage database on each side of the router for each session. The next step to determine the type of each attack is to conduct a final classification stage based on the Random Forest.

Security systems can detect unusual activities or behaviors on network systems. In many unusual acts, however, conventional safety systems including firewall and anti-

Š 2020, IRJET

|

Impact Factor value: 7.529

III. DATA MINING DETECTION

ASSISTS

IN

INTRUSION

The suggested proposed scheme is illustrated in figure. 1.

|

ISO 9001:2008 Certified Journal

|

Page 5640

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 07 Issue: 07 | July 2020

p-ISSN: 2395-0072

www.irjet.net

(iii)

Data Preprocessing

Clustering Genetic Algorithm

K-Mean Clustering

K-Means clustering algorithm is simplest and widely used clustering technique proposed by James Macqueen. In this algorithm, number of clusters K is specified by user means classifies instances into predefined number of cluster. The first step of K-Means clustering is to choose k instances as a center of clusters. Next assign each instances of dataset to nearest cluster. For instance assignment, measure the distance between centroid and each instances using Euclidean distance and according to minimum distance assign each and every data points into cluster. K –Means algorithm takes less execution time, when it applied on small dataset. When the data point increases to maximum then it takes maximum execution time. It is fast iterative algorithm but it is sensitive to outlier and noise.

Clustering Evaluation

Data Labeling Processes

Dataset Updating

Train data

Test data

Decision Tree

Decision Tree

(iv)

Apply Model

Using Genetic Algorithm

Evaluation Model

Data Preprocessing

Upload the data set: The desired data set is uploaded in this step to be used for data mining. Features selection: In step 1 the expected data set features are selected. My selection basis involves a general feature and a sub-set of features. Feature roles are described in this step: ' Roles ' determines the feature identity, whether it is normal, unique, labeled, etc. Conversion of nominal data to numerical data: nominal data in the clustering method must be translated to numerical. Normalization: Feature values based on Z-transformation method will be normalized in this step.

(ii)

(v)

đ??ˇ= đ?‘Ąđ?‘&#x;đ?‘‘đ?‘Žđ?‘Ąđ?‘ŽâˆŞđ?‘Ąđ?‘ đ?‘‘đ?‘Žđ?‘Ąđ?‘Ž (3)

Classification is the task of taking each and every instances of dataset under consideration and assigning it to a particular class normal and abnormal means known structure is used for new instances. It can be effective for both misuse detection and anomaly detection, but more frequently used for misuse detection. Classification categorized the datasets into predetermined sets. It is less efficient in intrusion detection as compared to clustering.

Different classification techniques such as decision tree, naive bayes classifier, K-nearest neighbour classifier, Support vector machine etc are used in IDS.

|

Impact Factor value: 7.529

Sub-Dataset Train & Test

After changes to the primary data collection, train and test subsets have been removed. For this reason, the updated data set of train and test subsets will increase to 70 and 30 percent respectively. The approach has been used to select various types of data, e.g. sampling without placement. The separation of data is done on the basis of eq(3-5).

D=Dataset, tr= train, ts= test

Classification

Š 2020, IRJET

Data Labeling & Dataset Updating

The proposed structure for supervised and unsupervised approaches in this report has been assumed to be applicable. The optimized clustering approach has been used for clustering data in the previous section. As a cluster members were tagged at this point and the data set up was subsequently revised as the architecture for classification model and system intrusion detection is subject to the specified labels for each data set. Members of the cluster are known by the names of the clusters.

Figure 1. Datamining Based IDS Architecture

(i)

K-Means Enhancement

{đ?‘Ąđ?‘&#x;đ?‘‘đ?‘Žđ?‘Ąđ?‘Ž}=70% đ?‘œđ?‘“ đ??ˇ (4) {đ?‘Ąđ?‘ đ?‘‘đ?‘Žđ?‘Ąđ?‘Ž}= đ??ˇâˆ’{đ?‘Ąđ?‘&#x;đ?‘‘đ?‘Žđ?‘Ąđ?‘Ž | đ?‘Ąđ?‘&#x;đ?‘‘đ?‘Žđ?‘Ąđ?‘ŽâˆŠđ?‘Ąđ?‘ đ?‘‘đ?‘Žđ?‘Ąđ?‘Ž =∅

(vi)

Enhancement of Decision Tree

The DT has analyzed the applied data on the system to identify data from top down. There was a feature label for each node in the DT. When a new node was formed at a certain point, a function was chosen to maximize its division power according to the records allocated to a particular sub-tree. The Gini index determined this

|

ISO 9001:2008 Certified Journal

|

Page 5641

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 07 Issue: 07 | July 2020

p-ISSN: 2395-0072

www.irjet.net

splitting power. The Gini coefficient is a way to calculate an impurity of nodes, as equation (6) shows:

[3] T. Zhang, R. Ramakrishnan, M. Livny, “BIRCH: an efficient data clustering method for very large databases�, in: Proceedings of SIGMOD, ACM, 1996, pp. 103–114.

[4] L. Khan, M. Awad, B. Thuraisingham, “A new intrusion detection system using support vector machines and hierarchical clustering�, The VLDB Journal 16(2007) 507– 521 [5] X. Xu, “Adaptive intrusion detection based on machine learning: feature extraction, classifier construction and sequential pattern prediction�, Information Assurance and Security 4 (2006) 237–246.

[6] J.X. Huang, J. Miao, Ben He, “High performance query expansion using adaptive co –training�, Information Processing & Management 49 (2) (2013) 441–453.

[7] Y. Li u, X. Yu, J.X. Huang, A.� An, Combining integrated sampling with SVM ensembles for learning from imbalanced datasets�, Information Processing &Management 47 (4) (2011) 617–631.

[8] V. Vapnik, “The Nature of Statistical Learning Theory�, Springer, 1999.

[9] Marcelloni, combining “supervised and unsupervised learning for data clustering�, Neural Computing & Applications 15 (3–4) (2006)289–297.

[10] C.-F. Tsai, Y.-F. Hsu, C.-Y. Lin, W.-Y. Lin, “Intrusion detection by machine learning: a review�, Expert Systems with Applications 36 (2009) 11994–12000.

[11] S.X. Wu, W. Banzhaf, “The use of computational intelligence in intrusion detection systems: a review�, Applied Soft Computing 10 (2010) 1–35.

[12] H. Brahmi, I. Brahmi, S.B. Yahia, “OMC-IDS: at the cross-roads of OLAP mining and intrusion detection�, in: Advances in Knowledge Discovery and Data Mining, in: LNCS, vol. 7302, 2012, pp. 13–24.

[13] S.-J. Horng, M.-Y. Su, Y.-H. Chen, T.-W. Kao, R.-J. Chen, J.-L. Lai, C.D. Perkasa,� A novel intrusion detection system based on hierarchical clustering and support vector machines�, Expert Systems with Applications 38 (2011) 306–313.

[14] Q. Zhang, G. Hu, W. Feng, and “Design and performance evaluation of a machine learning-based method for intrusion detection�, in: Software Engineering, Artificial Intelligence, Networking, and Parallel/Distributed computing, in: Studies in Computational Intelligence, vol. 295, Springer, 2010, pp.

69–83.

[15] T.A. Longstaff, J.T. Ellis, S.V. Hernan, H.F. Lipson, R.D. McMillan, L.H. Pazente,D. Simmel, “Security of the Internet�, in: F. Froehlich, A. Kent (Eds.), The Froehlich/Kent Encyclopedia of Telecommunications. Vol. 15, Marcel Derrek, 1998, pp. 231–254.

[16] S. Axelsson,� Research in intrusion detection systems a survey�, in: Tech. Rep.TR98-17, Chalmers University of Technology, Goteborg, Sweden, 2000.

đ??şđ??źđ?‘ đ??ź đ?‘Ľ =1− (đ?‘˜|đ?‘Ľ)2đ?‘˜ (đ?‘˜|đ?‘Ľ)2 is the sum of class k of node x record numbers to all node data. The worst division occurs when the less data in every category of the specified node is obtained in equal amounts. The more ideal and homogeneous is the larger the Gini coefficient of the node.

Confidence is one of the key parameters of the DT algorithm as the truncation error is observed. The DT algorithm GA function is shown in equation:

đ??šđ??š=đ??´đ?‘?đ?‘?đ?‘˘đ?‘&#x;đ?‘Žđ?‘?đ?‘Śâˆ’đ??śđ?‘™đ?‘Žđ?‘ đ?‘–đ?‘“đ?‘–đ?‘?đ?‘Žđ?‘Ąđ?‘–đ?‘œđ?‘› đ??¸đ?‘&#x;đ?‘&#x;đ?‘œđ?‘&#x;

IV. RESULTS AND DISCUSSION Many devices have safety violations that can quickly make them vulnerable and unable to be addressed. In addition, extensive work has been carried out on intrusion detection methods, which are still considered incomplete and not a complete method for intrusion. The role of network administrators and security experts also has become a highly priority and challenge So more stable systems cannot be replaced. So better performance is need for each intrusion detection methods. The proposed Datamining Based Techniques provides better performance compared to other existing methods.

V. CONCLUSION In this research a method focused on optimizing Kmean's clusters and DT classification algorithms is proposed to detect network intruders in a greater precise manner. For this feature the GA and the higher accuracy of the used classifier optimize total runs and trust. One of the most important characteristics is the applicability of this method for both supervised and unsupervised approaches.

The idea is to use the suggested model to test its generalization for future research in the field of network intrusion monitoring in different datasets.

REFERENCES [1] W. Lee, S.J. Stolfo, K.W. Mok, “A data mining framework for building intrusion detection models�, in: Proceedings of IEEE Symposium on Security and Privacy, 1999, pp. 120– 132.

[2] W. Feng, Q. Zhng, G. Hu, J Xiangji Huang,� Mining network data for intrusion detection through combining SVMs with ant colony networks �Future Generation Computer Systems,2013.

Š 2020, IRJET

|

Impact Factor value: 7.529

|

ISO 9001:2008 Certified Journal

|

Page 5642

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 07 Issue: 07 | July 2020

p-ISSN: 2395-0072

www.irjet.net

[17] S. Freeman, J. Branch, “Host-based intrusion detection using user signatures”, in: Proceedings of the Research Conference RPI., 2002.

[18] D. Marchette, “A statistical method for profiling network traffic”, in: Proceedings f Workshop on Intrusion Detection and Network Monitoring, 1999,pp. 119–128.

[19] T.F. Lunt, “A survey of intrusion detection techniques”, Computers and Security12 (4) (1993) 405– 418.

[20] J. Ryan, M.-J. Lin, R. Miikkulainen,”Intrusion detection with neural networks”, in: Proceedings of AAAI-97 Workshop on AI Approaches to Fraud Detection and Task Management, 1997, pp. 92–97.

[21] H. Teng, K. Chen, S. Lu, “Security audit trail analysis using inductively generated predictive rules”, in: Proceedings of the 6th Conference on Artificial Intelligence Applications, Vol. 1, 1990, pp. 24–29.

[22] D.E. Denning,” An intrusion-detection model”, IEEE Transactions on Software Engineering 13 (2) (1987)222– 232.

[23] F. Monrose, A. Rubin, “Authentication via keystroke dynamics”, in: Proceedings of the 4th ACM Conference on Computer and Communications Security, 1997.

© 2020, IRJET

|

Impact Factor value: 7.529

|

ISO 9001:2008 Certified Journal

|

Page 5643