Performance Analysis of Misuse Attack Data using Data Mining Classifiers

Abstract

Data mining can be characterized as the extraction of certain, already un-known, and conceivably valuable data from information. Various analysts have been creating security innovation and investigating new techniques to recognize digital assaults with the DARPA 1998 dataset for Intrusion Detection and adjusted renditions of this dataset KDDCup99 and NSL-KDD, yet as of not long ago nobody have inspected the execution of Top information mining calculations chose by specialists in information mining. The execution of these calculations are contrasted and precision, blunder rate and normal cost on changed renditions of NSL-KDD prepare and test dataset where the occasions are ordered into typical and four digital assault classes: DoS, Probing, R2L and U2R. Furthermore, the most vital highlights to identify digital assaults in all classifications and in every classification are assessed with Weka's Attribute Evaluator and positioned by Information Gain. The goal of this paper is to estimate the performance of classification models like logistic regression, artificial neural networks and support vector machines for predicting intrusions and these techniques are examined to improve the accuracy and performance of these models on KDDCUP dataset. The predictive models are developed using 42 input variable and 23 output variables from the attack set. We examined these data mining models in terms of their accuracy, sensitivity, specificity and FAR.  The regression model achieved an accuracy of 99.62%, sensitivity is 99.01%, and specificity is 92.18% with a FAR of 7.82. The Multilayer perceptron (ANN) model achieved an accuracy of 99.62%, sensitivity is 99.01%, and specificity is 91.03% with a FAR of 8.97. The last model Support vector machine model achieved an accuracy of 99.62%, sensitivity is 99.01%, and specificity is 88.00% with a FAR of 12.00. The logical regression model had the better false alarm, sensitivity and specificity, followed by the Multilayer perceptron model and the support vector machine model. The most imperative highlights to distinguish digital assaults are essential highlights, for example, the quantity of seconds of a system association, the convention utilized for the association, the system benefit utilized, ordinary or mistake status of the association and the quantity of information bytes sent. The most vital highlights to distinguish DoS, Probing and R2L assaults are essential highlights and the minimum critical highlights are content highlights. Dissimilar to U2R assaults, where the substance highlights are the most imperative highlights to identify assaults.