Open Access iconOpen Access

ARTICLE

crossmark

Unknown Attack Detection: Combining Relabeling and Hybrid Intrusion Detection

Gun-Yoon Shin1, Dong-Wook Kim1, Sang-Soo Kim2, Myung-Mook Han3,*

1 Department of Computer Engineering, Gachon University, Sungnam-si, 13120, Korea
2 Agency for Defense Development Songpa, Seoul, 05661, Korea
3 Department of Software, Gachon University, Sungnam-si, 13120, Korea

* Corresponding Author: Myung-Mook Han. Email: email

Computers, Materials & Continua 2021, 68(3), 3289-3303. https://doi.org/10.32604/cmc.2021.017502

Abstract

Detection of unknown attacks like a zero-day attack is a research field that has long been studied. Recently, advances in Machine Learning (ML) and Artificial Intelligence (AI) have led to the emergence of many kinds of attack-generation tools developed using these technologies to evade detection skillfully. Anomaly detection and misuse detection are the most commonly used techniques for detecting intrusion by unknown attacks. Although anomaly detection is adequate for detecting unknown attacks, its disadvantage is the possibility of high false alarms. Misuse detection has low false alarms; its limitation is that it can detect only known attacks. To overcome such limitations, many researchers have proposed a hybrid intrusion detection that integrates these two detection techniques. This method can overcome the limitations of conventional methods and works better in detecting unknown attacks. However, this method does not accurately classify attacks like similar to normal or known attacks. Therefore, we proposed a hybrid intrusion detection to detect unknown attacks similar to normal and known attacks. In anomaly detection, the model was designed to perform normal detection using Fuzzy c-means (FCM) and identify attacks hidden in normal predicted data using relabeling. In misuse detection, the model was designed to detect previously known attacks using Classification and Regression Trees (CART) and apply Isolation Forest (iForest) to classify unknown attacks hidden in known attacks. As an experiment result, the application of relabeling improved attack detection accuracy in anomaly detection by approximately 11% and enhanced the performance of unknown attack detection in misuse detection by approximately 10%.

Keywords


Cite This Article

APA Style
Shin, G., Kim, D., Kim, S., Han, M. (2021). Unknown attack detection: combining relabeling and hybrid intrusion detection. Computers, Materials & Continua, 68(3), 3289-3303. https://doi.org/10.32604/cmc.2021.017502
Vancouver Style
Shin G, Kim D, Kim S, Han M. Unknown attack detection: combining relabeling and hybrid intrusion detection. Comput Mater Contin. 2021;68(3):3289-3303 https://doi.org/10.32604/cmc.2021.017502
IEEE Style
G. Shin, D. Kim, S. Kim, and M. Han, “Unknown Attack Detection: Combining Relabeling and Hybrid Intrusion Detection,” Comput. Mater. Contin., vol. 68, no. 3, pp. 3289-3303, 2021. https://doi.org/10.32604/cmc.2021.017502



cc Copyright © 2021 The Author(s). Published by Tech Science Press.
This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
  • 2576

    View

  • 1684

    Download

  • 0

    Like

Share Link