A Local Feature Engineering Strategy to Improve Network Anomaly Detection

Salvatore Carta, Alessandro Sebastian Podda, Diego Reforgiato Recupero and Roberto Saia
Additional contact information
Salvatore Carta: Department of Mathematics and Computer Science, University of Cagliari, 09124 Cagliari, Italy
Alessandro Sebastian Podda: Department of Mathematics and Computer Science, University of Cagliari, 09124 Cagliari, Italy
Diego Reforgiato Recupero: Department of Mathematics and Computer Science, University of Cagliari, 09124 Cagliari, Italy
Roberto Saia: Department of Mathematics and Computer Science, University of Cagliari, 09124 Cagliari, Italy

Future Internet, 2020, vol. 12, issue 10, 1-30

Abstract: The dramatic increase in devices and services that has characterized modern societies in recent decades, boosted by the exponential growth of ever faster network connections and the predominant use of wireless connection technologies, has materialized a very crucial challenge in terms of security. The anomaly-based intrusion detection systems, which for a long time have represented some of the most efficient solutions to detect intrusion attempts on a network, have to face this new and more complicated scenario. Well-known problems, such as the difficulty of distinguishing legitimate activities from illegitimate ones due to their similar characteristics and their high degree of heterogeneity, today have become even more complex, considering the increase in the network activity. After providing an extensive overview of the scenario under consideration, this work proposes a Local Feature Engineering (LFE) strategy aimed to face such problems through the adoption of a data preprocessing strategy that reduces the number of possible network event patterns, increasing at the same time their characterization. Unlike the canonical feature engineering approaches, which take into account the entire dataset, it operates locally in the feature space of each single event. The experiments conducted on real-world data showed that this strategy, which is based on the introduction of new features and the discretization of their values, improves the performance of the canonical state-of-the-art solutions.

Keywords: intrusion detection; anomaly detection; networking; data preprocessing; machine learning (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2020
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
https://www.mdpi.com/1999-5903/12/10/177/pdf (application/pdf)
https://www.mdpi.com/1999-5903/12/10/177/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:12:y:2020:i:10:p:177-:d:432659

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().