Limon-Cantu David, Alarcon-Aquino Vicente
Department of Computing, Electronics and Mechatronics, Universidad de las Americas Puebla, San Andres Cholula, Puebla, Mexico.
PeerJ Comput Sci. 2021 Oct 19;7:e749. doi: 10.7717/peerj-cs.749. eCollection 2021.
Anomaly detection in computer networks is a complex task that requires the distinction of normality and anomaly. Network attack detection in information systems is a constant challenge in computer security research, as information systems provide essential services for enterprises and individuals. The consequences of these attacks could be the access, disclosure, or modification of information, as well as denial of computer services and resources. Intrusion Detection Systems (IDS) are developed as solutions to detect anomalous behavior, such as denial of service, and backdoors. The proposed model was inspired by the behavior of dendritic cells and their interactions with the human immune system, known as Dendritic Cell Algorithm (DCA), and combines the use of Multiresolution Analysis (MRA) Maximal Overlap Discrete Wavelet Transform (MODWT), as well as the segmented deterministic DCA approach (S-dDCA). The proposed approach is a binary classifier that aims to analyze a time-frequency representation of time-series data obtained from high-level network features, in order to classify data as normal or anomalous. The MODWT was used to extract the approximations of two input signal categories at different levels of decomposition, and are used as processing elements for the multi resolution DCA. The model was evaluated using the NSL-KDD, UNSW-NB15, CIC-IDS2017 and CSE-CIC-IDS2018 datasets, containing contemporary network traffic and attacks. The proposed MRA S-dDCA model achieved an accuracy of 97.37%, 99.97%, 99.56%, and 99.75% for the tested datasets, respectively. Comparisons with the DCA and state-of-the-art approaches for network anomaly detection are presented. The proposed approach was able to surpass state-of-the-art approaches with UNSW-NB15 and CSECIC-IDS2018 datasets, whereas the results obtained with the NSL-KDD and CIC-IDS2017 datasets are competitive with machine learning approaches.
计算机网络中的异常检测是一项复杂的任务，需要区分正常和异常情况。信息系统中的网络攻击检测是计算机安全研究中持续面临的挑战，因为信息系统为企业和个人提供重要服务。这些攻击的后果可能是信息的访问、泄露或修改，以及计算机服务和资源的拒绝服务。入侵检测系统（IDS）被开发出来作为检测异常行为（如拒绝服务和后门）的解决方案。所提出的模型受到树突状细胞的行为及其与人类免疫系统相互作用的启发，即树突状细胞算法（DCA），并结合了多分辨率分析（MRA）最大重叠离散小波变换（MODWT）以及分段确定性DCA方法（S-dDCA）。所提出的方法是一种二分类器，旨在分析从高级网络特征获得的时间序列数据的时频表示，以便将数据分类为正常或异常。MODWT用于在不同分解级别提取两个输入信号类别的近似值，并用作多分辨率DCA的处理元素。该模型使用包含当代网络流量和攻击的NSL-KDD、UNSW-NB15、CIC-IDS2017和CSE-CIC-IDS2018数据集进行评估。所提出的MRA S-dDCA模型在测试数据集上分别达到了97.37%、99.97%、99.56%和99.75%的准确率。文中还给出了与DCA和网络异常检测的最新方法的比较。所提出的方法在UNSW-NB15和CSECIC-IDS2018数据集上能够超越最新方法，而在NSL-KDD和CIC-IDS2017数据集上获得的结果与机器学习方法具有竞争力。
