Zhong, Yinzheng 
ORCID: 0000-0001-8477-3956, Goulermas, John Y and Lisitsa, Alexei
(2022)
Process Mining Algorithm for Online Intrusion Detection System.
[Preprint]
|
PDF
2205.12064v1.pdf - Other Download (3MB) | Preview |
Abstract
In this paper, we consider the applications of process mining in intrusion detection. We propose a novel process mining inspired algorithm to be used to preprocess data in intrusion detection systems (IDS). The algorithm is designed to process the network packet data and it works well in online mode for online intrusion detection. To test our algorithm, we used the CSE-CIC-IDS2018 dataset which contains several common attacks. The packet data was preprocessed with this algorithm and then fed into the detectors. We report on the experiments using the algorithm with different machine learning (ML) models as classifiers to verify that our algorithm works as expected; we tested the performance on anomaly detection methods as well and reported on the existing preprocessing tool CICFlowMeter for the comparison of performance.
| Item Type: | Preprint |
|---|---|
| Additional Information: | International Conference on Software Testing, Machine Learning and Complex Process Analysis |
| Uncontrolled Keywords: | cs.CR, cs.CR |
| Divisions: | Faculty of Science and Engineering > School of Electrical Engineering, Electronics and Computer Science |
| Depositing User: | Symplectic Admin |
| Date Deposited: | 31 May 2023 09:08 |
| Last Modified: | 15 Mar 2024 04:46 |
| DOI: | 10.48550/arxiv.2205.12064 |
| Related URLs: | |
| URI: | https://livrepository.liverpool.ac.uk/id/eprint/3170751 |
Dimensions
Dimensions
