Situation Awareness Network Intrusion Detection

Author

Mike Kesem, Boise State UniversityFollow

Publication Date

12-2021

Date of Final Oral Examination (Defense)

7-2-2021

Type of Culminating Activity

Thesis - Boise State University Access Only

Degree Title

Master of Science in Electrical and Computer Engineering

Department

Electrical and Computer Engineering

Supervisory Committee Chair

Sin Ming Loo, Ph.D.

Supervisory Committee Member

Liljana Babinkostova, Ph.D.

Supervisory Committee Member

Charmaine C. Sample, Ph.D.

Abstract

Current intrusion detection solutions are based on signature or rule-based detection. The large number of malwares have made common intrusion detection solutions ineffective. An ideal protection is having an all-in-one rewall which could stop all known malware while also able to flag new types of attack. It is possible that machine learning algorithms are the most effective method in detecting malware with very low to zero maintenance cost. The challenge with this is how machine learning algorithms will behave with new and unknown malware. It is vital for the algorithms to be able to adjust and accommodate new threats.

The research presented in this thesis increases network protection using anomaly detection by using machine learning. This method flags new types of attacks and existing ones by analyzing the characteristics of network traffic. In this research, IDS2018 and MAWILab are used to train the model.

This thesis shows that the smaller the time slice the better the prediction of anomalies. This is due to the nature of machine learning in detecting repetitive patterns which is a suitable technique in flagging anomalies that do not belong to the desired pattern.

DOI

https://doi.org/10.18122/td/1884/boisestate

Recommended Citation

Kesem, Mike, "Situation Awareness Network Intrusion Detection" (2021). Boise State University Theses and Dissertations. 1884.
https://doi.org/10.18122/td/1884/boisestate