Sharma Ankita, Rani Shalli, Sah Dipak Kumar, Khan Zahid, Boulila Wadii
Chitkara University Institute of Engineering and Technology, Chitkara University, Rajpura 140401, Punjab, India.
Department of Computer Engineering and Applications, GLA University, Mathura 281406, Uttar Pradesh, India.
Sensors (Basel). 2023 Oct 9;23(19):8333. doi: 10.3390/s23198333.
The comparison of low-rank-based learning models for multi-label categorization of attacks for intrusion detection datasets is presented in this work. In particular, we investigate the performance of three low-rank-based machine learning (LR-SVM) and deep learning models (LR-CNN), (LR-CNN-MLP) for classifying intrusion detection data: Low Rank Representation (LRR) and Non-negative Low Rank Representation (NLR). We also look into how these models' performance is affected by hyperparameter tweaking by using Guassian Bayes Optimization. The tests has been run on merging two intrusion detection datasets that are available to the public such as BoT-IoT and UNSW- NB15 and assess the models' performance in terms of key evaluation criteria, including precision, recall, F1 score, and accuracy. Nevertheless, all three models perform noticeably better after hyperparameter modification. The selection of low-rank-based learning models and the significance of the hyperparameter tuning log for multi-label classification of intrusion detection data have been discussed in this work. A hybrid security dataset is used with low rank factorization in addition to SVM, CNN and CNN-MLP. The desired multilabel results have been obtained by considering binary and multi-class attack classification as well. Low rank CNN-MLP achieved suitable results in multilabel classification of attacks. Also, a Gaussian-based Bayesian optimization algorithm is used with CNN-MLP for hyperparametric tuning and the desired results have been achieved using c and γ for SVM and α and β for CNN and CNN-MLP on a hybrid dataset. The results show the label UDP is shared among analysis, DoS and shellcode. The accuracy of classifying UDP among three classes is 98.54%.
本文介绍了用于入侵检测数据集攻击多标签分类的基于低秩的学习模型的比较。具体而言，我们研究了三种基于低秩的机器学习（LR-SVM）和深度学习模型（LR-CNN）、（LR-CNN-MLP）对入侵检测数据进行分类的性能：低秩表示（LRR）和非负低秩表示（NLR）。我们还通过使用高斯贝叶斯优化来研究这些模型的性能如何受到超参数调整的影响。测试在合并两个公开可用的入侵检测数据集（如BoT-IoT和UNSW-NB15）上运行，并根据关键评估标准（包括精确率、召回率、F1分数和准确率）评估模型的性能。然而，在超参数修改后，所有三个模型的性能都有显著提升。本文讨论了基于低秩的学习模型的选择以及超参数调整日志对入侵检测数据多标签分类的重要性。除了支持向量机（SVM）、卷积神经网络（CNN）和卷积神经网络-多层感知器（CNN-MLP）外，还使用了具有低秩分解的混合安全数据集。通过考虑二进制和多类攻击分类也获得了所需的多标签结果。低秩CNN-MLP在攻击的多标签分类中取得了合适的结果。此外，基于高斯的贝叶斯优化算法与CNN-MLP一起用于超参数调整，并且在混合数据集上使用支持向量机的c和γ以及CNN和CNN-MLP的α和β获得了所需的结果。结果表明，标签UDP在分析、拒绝服务（DoS）和壳代码之间共享。在三个类别中对UDP进行分类的准确率为98.54%。
