Weighted Trustworthiness for ML Based Attacks Classification

Abstract

Recently, machine learning techniques are gaining a lot of interest in security applications as they exhibit fast processing with real-time predictions. One of the significant challenges in the implementation of these techniques is the collection of a large amount of training data for each new potential attack category, which is most of the time, unfeasible. However, learning from datasets that contain a small training data of the minority class usually produces a biased classifiers that have a higher predictive accuracy for majority class(es), but poorer predictive accuracy over the minority class. In this paper, we propose a new designed attacks weighting model to alleviate the problem of imbalanced data and enhance the accuracy of minority classes detection. In the proposed system, we combine a supervised machine learning algorithm with the node <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup> past information. The machine learning algorithm is used to generate a classifier that differentiates between the investigated attacks. Then, the system stores these decisions in a database and exploits them for the weighted attacks classification model. Thus, for each attack class, the weight that maximizes the detection of the minority classes will be computed and the final combined decision is generated. In this work, we use the UNSW dataset to train the supervised machine learning model. The simulation results show that the proposed model can effectively detect intrusion attacks and provide better accuracy, detection rates and lower false alarm rates compared to state-of-the art techniques. <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup> In this document we will use the words “node” to represent computing, storage, physical, and virtual machines.