Communication Dans Un Congrès Année : 2024

Automated and Improved Detection of Cyber Attacks via an Industrial IDS Probe

Résumé

Network flow classification allows to distinguish normal flows from deviant behaviors. However, given the diversity of the approaches proposed for intrusion detection via IDS probes, an adequate fundamental solution is required. Indeed, most of existing solutions address a specific context which does not allow to assess the efficiency of the proposed models on a different context. Therefore, we propose in this paper an approach for malicious flow detection based on One Dimensional Convolutional Neural Networks (1D-CNN). Our solution extracts features based on the definition of network flows. Thus, it can be common to any network flow classification model. This feature engineering phase is coupled to CNN’s feature detector in order to provide an efficient classification approach. To evaluate its performance, our solution has been evaluated on two different datasets (a recent dataset extracted from a real IBM industrial context and the NSL-KDD dataset that is widely used in the literature). Moreover, a comparison with existing solutions has been provided to NSL-KDD dataset. Attacks in both datasets have been defined using the globally-accessible knowledge base of adversary tactics and techniques MITRE framework. The evaluation results have shown that our proposed solution allows an efficient and accurate classification in both datasets (with an accuracy rate of 94% at least). Moreover, it outperforms existing solutions in terms of classification metrics and execution time as well.
Fichier sous embargo
Fichier sous embargo
1 10 11
Année Mois Jours
Avant la publication
vendredi 1 janvier 2027
Fichier sous embargo
vendredi 1 janvier 2027
Connectez-vous pour demander l'accès au fichier

Dates et versions

hal-04953449 , version 1 (20-12-2023)
hal-04953449 , version 2 (18-02-2025)

Licence

Identifiants

Citer

Almamy Touré, Youcef Imine, Thierry Delot, Antoine Gallais, Alexis Semnont, et al.. Automated and Improved Detection of Cyber Attacks via an Industrial IDS Probe. 38th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2023, Poznan, Poland. pp.191-206, ⟨10.1007/978-3-031-56326-3_14⟩. ⟨hal-04953449v2⟩
68 Consultations
75 Téléchargements

Altmetric

Partager

More