Building Predictive Models For Learning From Rare Class : A Comparative Study

tools will help to detect intrusions and other suspicious activities on the network. The third challenge is to improve the

KDDCup99 dataset was introduced at the Third International Knowledge Discovery and Data Mining Tools Competition which was held by DARPA in 1999 .KDDCup99 is a refined data set from DARPA 1998 dataset as it contains only network data[3]. KDDCup99 is commonly used developers and implementers of new IDS to evaluate their systems. IDS systems take the KDDCup99 dataset as an input to train ,test the system and check performance of the IDS in classifying and detecting attack records. KDDCup99 dataset is used by most researchers because it contains 22 different attack types which could be classified into four main attack categories of the network discussed in the previous section. The full DARPA dataset consists of relatively 4,900,000 lines of connection vectors where each single connection vectors consists of 41 features and is marked as either normal or an attack, with exactly one particular attack type [38]. Among the 41 features of the connection, only sixteen significant attributes are considered which are: A1,A5,A6,A8, A9, A10, A11, A13, A16, A17, A18, A19, A23, A24, A32, A33[38] The KDD 99

CSEC 630 Lab2 -Intrusion Detection System and Protocol Analysis Lab (n.d.). University of Maryland University College. Retrieved from: https://learn.umuc.edu/d2l/common/viewFile.d2lfile/Database/NzkyMzkw/CSEC630_lab2_LEO.pdf?ou=33745

Interruption identification frameworks (IDS) take either system or host based methodology for perceiving and redirecting assaults. In either case, these items search for assault marks (particular examples) that for the most part demonstrate malignant or suspicious goal. At the point when an IDS searches for these examples in system activity then it is system based (figure 1). At the point when an IDS searches for assault marks in log records, then it is host based.

Perception for interruption location helps a security head to perceive irregular conduct in an intuitional way. Representation of interruption location empowers quick examination and reaction in light of the fact that an interruption is perceived intuitionally. In this way, it can overcome alarm flooding. Most interruption discovery strategies with perception are peculiarity based identification systems and envision review information as opposed to the ready itself. [5].The host-based perception strategy for interruption discovery is to learn ordinary conditions of recognizes or projects that is accomplished by the client and contrasts review information and profiles for representation.

Cyber-attacks intruding network systems is a threat the economy, national and public safety. Computer system pirates are the possible persons who can form groups that can attack the nation and cause the negative impact to the country's attack. More research should be done in the networking area to monitor systems performance and detect any malice attacks as soon as possible with correct advanced measures taken to solve the problems.

Network Traffic Monitoring and analysis is essential to more effectively troubleshoot and resolve issues when they occur, to not bring network services to a standstill for extended periods. Numerous software tools are available to help administrators with the monitoring and detects cyber threats in network traffic. This paper will discuss software that can monitor Network Traffic, which helps detect cyber threats. The following is software based monitoring that detect cyber threats;

Ping sweeps and ports scans are a common ways for hackers to probe a network and attempt to break into it. Although network probes are technically not intrusions themselves, they should not be taken lightly—they may lead to actual intrusions in the future. In the information that follows, I will provide a standard definition of a ping sweep and port scan, the possible uses of the two, and the prevention methods which are in place in our company to combat ping sweeps and port scans of our network by would be attackers.

The correct configuration of security technologies is mandatory to balance the need for access and safety of information (Cavusoglu & Raghunathan, 2009). Many companies use the layered approach to ensure protection of their network information system (Cavusoglu & Raghunathan, 2009). By using this approach, many security technologies rely on each other to operate effectively (Cavusoglu & Raghunathan, 2009). Three technologies commonly used together are Intrusion Detection Systems, Intrusion Prevention Systems, and firewalls. When configured properly, these technologies complement each other (Cavusoglu & Raghunathan, 2009).

After the bug is made known publicly, the exploit raises five times the magnitude” ([ANU], 2013). By utilizing algorithms from data-mining, identifies the frequency of the exploit and can add a rating of the potential of the threat impacting new versions of software enhancing a defense strategy. Studies show that threats can be identified with a 98.5% accuracy with 2.5% false positive rate. Understanding the delta between accepted and behavior mimicking a compromising behavior better equips professionals awareness of a threat or exploit.

Network traffic visualization method designed by Mazurczyk (2012) focuses on network anomaly detection principles. Mazurczyk’s main purpose of doing his research was to detect anomalies in network traffic flow, that can cause malicious actions that could compromise network security. Typical anomaly detection methods instituted across networks focus on discovering illegal activities orchestrated by probable attackers (Mazurczyk, et al., 2012). Current security devices lack the effectiveness needed in today’s immense traffic volumes that need current real-time

In the world of cybersecurity, machine learning focuses on making predictions that are based on the thousands of properties gleaned from earlier data. Signatures, behaviors, heuristics and other current techniques rely on data points that are as simplistic as they are easy to evade. The primary differentiator of this new technology is that previously unknown attacks are detectable, even those that are not yet conceived or written, but the detection of previously known attacks is not sacrificed. In essence, this type of machine learning delivers the power to predict future attacks.

of unique attack sources per day. To take a closer look at this phenomenon, we present

Internet has grown leap and bounds over the last few years. This has resulted in a number of computer security breaches on the Internet. Most of the computers that use Internet are vulnerable to attack. Due to this reason, Intrusion Detection systems have grown rapidly and there is an ongoing research since it’s a developing field. ID (Intrusion Detection) is a type of a security management system that gathers and analyzes information to identify security breaches, which include both, attacks from outside the organization and attacks from inside as well (misuse). ID includes analysis of abnormal activity, tracking user policy violations, assessing systems and file integrity and vulnerability. It helps us differentiate the normal behavior of system and helps us obtain any abnormal activity that is taking place. This can be done easily using data mining and it helps increase its sustainability to attacks.

As networks and computer systems become universal and exposed, security threats and risks continue to grow more rapidly. This causes enormous threats; therefore, Security specialists and experts are continuously trying to find solutions for these kinds of threats through different methods like attack signatures and looking for methods to prevent them. Nevertheless, as solutions are formed, new types of threats emerge, for example spam mails, spywares, worms and Trojans just to mention a few.