Conference Papers Year : 2024

Automated and Improved Detection of Cyber Attacks via an Industrial IDS Probe

Abstract

Network flow classification allows to distinguish normal flows from deviant behaviors. However, given the diversity of the approaches proposed for intrusion detection via IDS probes, an adequate fundamental solution is required. Indeed, most of existing solutions address a specific context which does not allow to assess the efficiency of the proposed models on a different context. Therefore, we propose in this paper an approach for malicious flow detection based on One Dimensional Convolutional Neural Networks (1D-CNN). Our solution extracts features based on the definition of network flows. Thus, it can be common to any network flow classification model. This feature engineering phase is coupled to CNN’s feature detector in order to provide an efficient classification approach. To evaluate its performance, our solution has been evaluated on two different datasets (a recent dataset extracted from a real IBM industrial context and the NSL-KDD dataset that is widely used in the literature). Moreover, a comparison with existing solutions has been provided to NSL-KDD dataset. Attacks in both datasets have been defined using the globally-accessible knowledge base of adversary tactics and techniques MITRE framework. The evaluation results have shown that our proposed solution allows an efficient and accurate classification in both datasets (with an accuracy rate of 94% at least). Moreover, it outperforms existing solutions in terms of classification metrics and execution time as well.
Embargoed file
Embargoed file
1 10 10
Year Month Jours
Avant la publication
Friday, January 1, 2027
Embargoed file
Friday, January 1, 2027
Please log in to request access to the document

Dates and versions

hal-04953449 , version 1 (20-12-2023)
hal-04953449 , version 2 (18-02-2025)

Licence

Identifiers

Cite

Almamy Touré, Youcef Imine, Thierry Delot, Antoine Gallais, Alexis Semnont, et al.. Automated and Improved Detection of Cyber Attacks via an Industrial IDS Probe. 38th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2023, Poznan, Poland. pp.191-206, ⟨10.1007/978-3-031-56326-3_14⟩. ⟨hal-04953449v2⟩
68 View
75 Download

Altmetric

Share

More