Enhanced Network Anomaly Detection Model

Based On Supervised Learning Techniques with

Qualitative Features Selection

Muhammad Shahid Azeem

MS160400843
MS. Computer Science
Virtual University of Pakistan
 Abstract

Massive growth in the Internet

Increasing Importance of cyber
security
 Numerous new threats to data
Intrusion Detection System (IDS)
Primary defence mechanism
 Abstract

Secure data and resources from illegal

disclosure and unauthorized access.
Data Security Approaches
Signature based IDS
Anomaly Detection based IDS
 
 Problem Statement

 To propose an Anomaly Based Intrusion

detection System with enhanced
performance.
Supervised Learning Techniques
Qualitative Features along with
Quantitative Features.
 Research Questions

 How inclusion of qualitative features does

increase the performance of anomaly
detection model?

 Which encoding schemes are appropriate to

quantify qualitative features?
 Research Objectives

 To propose an appropriate Intrusion detection

system using supervised learning techniques.
 Performance and accuracy enhancement of
Model
 Qualitative features along with quantitative features
 Qualitative features are difficult to measure.
 Eencoding of Qualitative Features in quantitative
form
 Features Selection

Accuracy of Intrusion Detection

Features selection.
 Quantitative Features.
Qualitative Feature
. Most of Studies rely on
Quantitative Features
 Encoding of Qualitative Features

Quantification of Qualitative
Features.
Encoding
 Binary Encoder, Hashing Encoder, Helmert Encoder,
OneHotEncoder, OrdinalEncoder, SumEncoder,
PolynomialEncoder, BaseNEncoder, LeaveOneOutEncoder,
TargetEncoder.
Supervised Learning Techniques

Supervised learning techniques.

Nearest Neighbour
Random Forest
Multilevel perceptron
 Decision tree
 Performance Evaluation Measures

Following matrices will be used for performance

evaluation of supervised learning techniques.
Precision
Recall
Accuracy
ROC curve
Types of Attacks Considered

Following attacks are considered in this study.

 Analysis
 Backdoors
 Exploits
 DoS
 Fuzzers
 Generic
 Reconnaissance
 Shellcode
 Training and Testing

The proposed model will be trained and

tested on UNSW-NB15 data set.
Experimental results will be recorded
and compared for suitability of anomaly
detection model against the UNSW-
NB15 data set and state of the art IDSs
from literature.
Any Question

Allah Hafiz