Why machine learning algorithms fail in misuse detection on KDD intrusion detection data set
Abstract
A large set of machine learning and pattern classification algorithms trained and tested on KDD intrusion detection data set failed to identify most of the user-to-root and remote-to-local attacks, as reported by many researchers in the literature. I
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Sabhnani and Serpen expose that no classifiers can be trained successfully on the KDD dataset to perform misuse detection for U2R or R2L attack categories, due to deficiencies and limitations of the KDD dataset rather than inadequacies of the proposed algorithms.
“In fact, Sabhnani and Serpen [398] expose that no classifiers can be trained successfully on the KDD dataset to perform misuse detection for U2R or R2L attack categories.This is due to the deficiencies and limitations of the KDD dataset rather than the inadequacies of the proposed algorithms.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [398]
The training and testing datasets represent dissimilar hypothesis for the U2R and R2L attack categories, so any algorithm that attempts to learn the signature of these attacks using the training dataset is bound to perform poorly on the testing dataset.
“The authors found via multiple analysis techniques that the training and testing datasets represent dissimilar hypothesis for the U2R and R2L attack categories; so if one would employ any algorithm that attempts to learn the signature of these attacks using the training dataset is bound to perform poorly on the testing dataset.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [398]
The citation lists haven’t been fetched yet
References 17 · Cited by 148
- Authors
- Sabhnani, M., & Serpen, G.
- Affiliations
- University of Toledo (US)
- Electrical Engineering and Computer Science Department, The University of Toledo, Toledo, OH 43606, USA
- Venue
- Intelligent Data Analysis
- Publisher
- SAGE Publications
- Published
- 2004-10-14
- Volume
- 8
- Issue
- 4
- Pages
- 403-415
- ISSN
- 1088-467X (ISSN-L)
- 1571-4128
- OpenAlex
- W1866355538
- Cited by
- 148
- References
- 17
- Citations by year
- 2024: 2 · 2023: 2 · 2022: 4 · 2021: 9 · 2020: 10 · 2019: 5 · 2018: 11 · 2017: 8 · 2016: 3 · 2015: 10 · 2014: 8 · 2013: 5 · 2012: 13
- FWCI
- 7.49
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- Intelligent Data Analysis (publishedVersion)
- Funders
- University of California, Irvine
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- signature-based detection, network intrusion detection, user-to-root attacks, remote-to-local attacks, attack classification, pattern classification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
