Methodology for the Detection of Contaminated Training Datasets for Machine Learning-Based Network...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Network Intrusion-Detection Systems (NIDS) are crucial for detecting cyber-attacks.
• Anomaly-based NIDS rely on machine learning models trained on labelled datasets.
• Mislabeled data in training sets can significantly degrade NIDS performance.

Purpose of the Study:

• To address the challenge of mislabelled network traffic datasets in anomaly-based NIDS.
• To develop a methodology for analyzing dataset quality and identifying hidden anomalies.
• To optimize NIDS performance by selecting ideal training subsets, even with mislabelled data.

Main Methods:

• A novel two-step methodology is proposed to analyze network traffic dataset quality.
• The method identifies hidden or unidentified anomalies within existing datasets.
• It involves an incremental selection of data subsets to train anomaly detection models.

Main Results:

• The proposed methodology successfully identified hidden botnet attacks in the contaminated UGR'16 dataset.
• Experiments demonstrated the feasibility of revealing mislabelled data, including normal traffic labelled as anomalous.
• The approach improved the performance of a state-of-the-art NIDS (Kitsune) on the compromised dataset.

Conclusions:

• The developed methodology effectively enhances the robustness of anomaly-based NIDS against dataset mislabelling.
• It provides a reliable way to improve the accuracy of intrusion detection systems.
• This approach is crucial for maintaining effective network security in the face of evolving cyber threats.