Detection of Anomalies in Network using Machine Learning

Detection of Anomalies in Network using Machine Learning

Prof.Naresh Thoutam (Guide)

Author: Mayur Sonawane, Ghanshyam Chaudhari, Om kathe, Prajwal Sontakke

Department of Computer Engineering

Sandip Institute of Technology & Research Center®, Nashik, India

Abstract

The Intrusion Detection System, also known as IDS, is the most widely used method to detect and filter malicious network requests. They are placed at a strategic point to monitor traffic to and from all devices on the network. With the help of VMs and advanced switches, most networking devices can use an IDS. Though the traditional Signature Based Intrusion Detection System known as SIDS gives good accuracy, it cannot detect many new-age intrusions such as zero-day attacks as SIDS is based on pattern matching technique. Instead, machine learning, statistical-based, and knowledge-based methods can detect most newly founded attacks. Any significant deviation between the observed behavior and the model is considered an anomaly. The development of these models comprises two phases: the training phase and the testing phase. In the training phase, the average traffic profile is used to learn a model of normal behavior. Then in the testing phase, a new data set is used to establish the system’s capacity to generalize to previously unseen intrusions. In this paper, we have used an unsupervised machine-learning algorithm called Isolation Forest to detect anomalies in network traffic. The algorithm detects the outliers based on the anomaly score. To train and test, the KDD data set has been used, which is a well-known benchmark in the research of Intrusion Detection techniques.

Keywords: industrial control systems; anomaly detection; machine learning; network security