Examining traffic microstructures to improve model development

Henry Clausen; David Aspinall

doi:10.1109/SPW53761.2021.00011

Examining traffic microstructures to improve model development

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

We demonstrate how machine-learning-based network intrusion detection models can be validated and developed by probing models using traffic with specifically controlled microstructures. We show our methodology by probing two published state-of-the-art models to find classification flaws and and understand misbehaviour. These models fail for input traffic with particular characteristics such as retransmissions or overly dispersed flow interarrival times. After we make simple corresponding model corrections, detection rates already improve between 2 -4%. We believe this shows promise for using tailored data with controllable and labelled characteristics to effectively improve model development in NID, a practice that helped model development significantly in several other areas of machinelearning.

Original language	English
Title of host publication	2021 IEEE Security and Privacy Workshops (SPW)
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	19-24
Number of pages	6
ISBN (Electronic)	978-1-6654-3732-5
ISBN (Print)	978-1-6654-3733-2
DOIs	https://doi.org/10.1109/SPW53761.2021.00011
Publication status	Published - 8 Jul 2021
Event	42nd IEEE Symposium on Security and Privacy - Online, San Francisco, United States Duration: 24 May 2021 → 27 May 2021 https://www.ieee-security.org/TC/SP2021/index.html

Symposium

Symposium	42nd IEEE Symposium on Security and Privacy
Abbreviated title	SP 2021
Country/Territory	United States
City	San Francisco
Period	24/05/21 → 27/05/21
Internet address	https://www.ieee-security.org/TC/SP2021/index.html

Keywords

Machine learning
traffic microstructures
network intrusion detection

Access to Document

10.1109/SPW53761.2021.00011Licence: All Rights Reserved

Examining traffic microstructures_CLAUSEN_DOA09032021_AFVAccepted author manuscript, 291 KBLicence: All Rights Reserved

https://ieeexplore.ieee.org/abstract/document/9474331Licence: All Rights Reserved

Cite this

@inproceedings{1231a1b6ec86458788402619c6a221dd,

title = "Examining traffic microstructures to improve model development",

abstract = "We demonstrate how machine-learning-based network intrusion detection models can be validated and developed by probing models using traffic with specifically controlled microstructures. We show our methodology by probing two published state-of-the-art models to find classification flaws and and understand misbehaviour. These models fail for input traffic with particular characteristics such as retransmissions or overly dispersed flow interarrival times. After we make simple corresponding model corrections, detection rates already improve between 2 -4%. We believe this shows promise for using tailored data with controllable and labelled characteristics to effectively improve model development in NID, a practice that helped model development significantly in several other areas of machinelearning.",

keywords = "Machine learning, traffic microstructures, network intrusion detection",

author = "Henry Clausen and David Aspinall",

year = "2021",

month = jul,

day = "8",

doi = "10.1109/SPW53761.2021.00011",

language = "English",

isbn = "978-1-6654-3733-2",

pages = "19--24",

booktitle = "2021 IEEE Security and Privacy Workshops (SPW)",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "42nd IEEE Symposium on Security and Privacy, SP 2021 ; Conference date: 24-05-2021 Through 27-05-2021",

url = "https://www.ieee-security.org/TC/SP2021/index.html",

}

TY - GEN

T1 - Examining traffic microstructures to improve model development

AU - Clausen, Henry

AU - Aspinall, David

PY - 2021/7/8

Y1 - 2021/7/8

N2 - We demonstrate how machine-learning-based network intrusion detection models can be validated and developed by probing models using traffic with specifically controlled microstructures. We show our methodology by probing two published state-of-the-art models to find classification flaws and and understand misbehaviour. These models fail for input traffic with particular characteristics such as retransmissions or overly dispersed flow interarrival times. After we make simple corresponding model corrections, detection rates already improve between 2 -4%. We believe this shows promise for using tailored data with controllable and labelled characteristics to effectively improve model development in NID, a practice that helped model development significantly in several other areas of machinelearning.

AB - We demonstrate how machine-learning-based network intrusion detection models can be validated and developed by probing models using traffic with specifically controlled microstructures. We show our methodology by probing two published state-of-the-art models to find classification flaws and and understand misbehaviour. These models fail for input traffic with particular characteristics such as retransmissions or overly dispersed flow interarrival times. After we make simple corresponding model corrections, detection rates already improve between 2 -4%. We believe this shows promise for using tailored data with controllable and labelled characteristics to effectively improve model development in NID, a practice that helped model development significantly in several other areas of machinelearning.

KW - Machine learning

KW - traffic microstructures

KW - network intrusion detection

U2 - 10.1109/SPW53761.2021.00011

DO - 10.1109/SPW53761.2021.00011

M3 - Conference contribution

SN - 978-1-6654-3733-2

SP - 19

EP - 24

BT - 2021 IEEE Security and Privacy Workshops (SPW)

PB - Institute of Electrical and Electronics Engineers (IEEE)

T2 - 42nd IEEE Symposium on Security and Privacy

Y2 - 24 May 2021 through 27 May 2021

ER -

Examining traffic microstructures to improve model development

Abstract

Symposium

Keywords

Access to Document

Fingerprint

Cite this