The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems

The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems

Apruzzese, Giovanni (Universität Liechtenstein)
Pajola, Luca (Università degli Studi di Padova)
Conti, M. (TU Delft Cyber Security; Università degli Studi di Padova)

2022

Enhancing Network Intrusion Detection Systems (NIDS) with supervised Machine Learning (ML) is tough. ML-NIDS must be trained and evaluated, operations requiring data where benign and malicious samples are clearly labeled. Such labels demand costly expert knowledge, resulting in a lack of real deployments, as well as on papers always relying on the same outdated data. The situation improved recently, as some efforts disclosed their labeled datasets. However, most past works used such datasets just as a 'yet another' testbed, overlooking the added potential provided by such availability. In contrast, we promote using such existing labeled data to cross-evaluate ML-NIDS. Such approach received only limited attention and, due to its complexity, requires a dedicated treatment. We hence propose the first cross-evaluation model. Our model highlights the broader range of realistic use-cases that can be assessed via cross-evaluations, allowing the discovery of still unknown qualities of state-of-the-art ML-NIDS. For instance, their detection surface can be extended - at no additional labeling cost. However, conducting such cross-evaluations is challenging. Hence, we propose the first framework, XeNIDS, for reliable cross-evaluations based on Network Flows. By using XeNIDS on six well-known datasets, we demonstrate the concealed potential, but also the risks, of cross-evaluations of ML-NIDS.

Machine Learning
Intrusion Detection Systems
Network Security
Evaluation

http://resolver.tudelft.nl/uuid:d427c9f5-321b-4038-964b-74e01f86a448

https://doi.org/10.1109/TNSM.2022.3157344

2023-07-01

1932-4537

IEEE Transactions on Network and Service Management, 19 (4), 5152 - 5169

Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

Institutional Repository

journal article

© 2022 Giovanni Apruzzese, Luca Pajola, M. Conti