FAFS: A Fuzzy Association Feature Selection Method for Network Malicious Traffic Detection = FAFS: A Fuzzy Association Feature Selection Method for Network Malicious Traffic Detection

다국어 초록 (Multilingual Abstract)

Analyzing network traffic is the basis of dealing with network security issues. Most of the network security systems depend on the feature selection of network traffic data and the de-tection ability of malicious traffic in network can be improved by the correct method of feature selection. An FAFS method, which is short for Fuzzy Association Feature Selection method, is proposed in this paper for network malicious traffic detection. Association rules, which can reflect the relationship among different characteristic attributes of network traffic data, are mined by association analysis. The membership value of association rules are obtained by the calculation of fuzzy reasoning. The data features with the highest correlation intensity in network data sets are calculated by comparing the membership values in association rules. The dimension of data features are reduced and the detection ability of malicious traffic detection algorithm in network is improved by FAFS method. To verify the effect of malicious traffic feature selection by FAFS method, FAFS method is used to select data features of different dataset in this paper. Then, K-Nearest Neighbor algorithm, C4.5 Decision Tree algorithm and Naïve Bayes algorithm are used to test on the dataset above. Moreover, FAFS method is also compared with classical feature selection methods. The analysis of experimental results show that the precision and recall rate of malicious traffic detection in the network can be signifi-cantly improved by FAFS method, which provides a valuable reference for the establishment of network security system.

참고문헌 (Reference)

1 R. Khosravanian, "Weight on drill bit prediction models : Sugeno-type and mamdani-type fuzzy inference systems compared" 36 : 280-297, 2016

2 Xiyue Deng, "Understanding Malware’s Network Behaviors using Fantasm" 1-11, 2017

3 Wen Gao, "The Divide-Conquer and Voting Strategy for Traffic Feature Selection" 43 (43): 795-799, 2015

4 Christian Rossow, "Sandnet : Network Traffic Analysis of Malicious Software" 77-78, 2011

5 Fei Tang, "Random Forest Missing Data Algorithms" 10 (10): 221-246, 2017

6 Frederico Coelho, "Multi-Objective Semi-Supervised Feature Selection and Model Selection Based on Pearson’s Correlation Coefficient" 6419 (6419): 509-516, 2010

7 "Modbus_traffic"

8 "KDDCup1999Data"

9 Zhihong Zhang, "Joint hypergraph learning and sparse regression for feature selection" 63 : 291-309, 2017

10 T. V. Avdeenko, "Integration of Case-based and Rule-based Reasoning Through Fuzzy Inference in Decision Support Systems" 103 : 447-453, 2017

11 Wei Wang, "HAST-IDS : Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection" 6 (6): 1792-1806, 2017

12 Jundong Li, "Feature selection: a data perspective" 50 : 94:1-94:5, 2017

13 Mohd Mahmood Ali, "Extracting useful rules through improved decision tree induction using information entropy" 3 (3): 27-41, 2013

14 Qilei Yin, "Detection of Attack Time Series Association Rules Based on Apriori Algorithms" (9) : 2-7, 2014

15 "DARPA Intrusion Detection Evaluation"

16 Jose Andre Morales, "Analyzing and exploiting network behaviors ofMalware" 50 : 20-34, 2010

17 Sergio Ramírez-Gallego, "An information theory-based feature selection framework for big data under apache spark" 48 : 1441-1453, 2018

18 A. Salama, "Adaptive Sampling Technique for Computer Network Traffic Parameters Using a Combination of Fuzzy System and Regression Model" 206-211, 2017

19 Razieh Sheikhpour, "A survey on semi-supervised feature selection methods" 64 : 141-158, 2017

20 Xingbin Sun, "A feature selection method for multi-class network traffic" 34 (34): 568-571, 2017

21 Xingbin Sun, "A Statistical Frequency-Based Method for Network Traffic Feature Selection" 37 (37): 2483-2487, 2016