Evaluation of Support Vector Machine Kernels for Detecting Network Anomalies

Size: px

Start display at page:

Download "Evaluation of Support Vector Machine Kernels for Detecting Network Anomalies"

Emily McGee
5 years ago
Views:

1 Evaluatio of Support Vector Machie Kerels for Detectig Network Aomalies Prera Batta, Maider Sigh, Zhida Li, Qigye Dig, ad Ljiljaa Trajković Commuicatio Networks Laboratory School of Egieerig Sciece Simo Fraser Uiversity

2 Roadmap Itroductio: Border Gateway Protocol (BGP) Machie learig Feature extractio ad selectio Support vector machie ad kerels Experimetal procedure ad classificatio results Coclusios ad refereces ISCAS 2018, Florece, Italy 2

3 Roadmap Itroductio Border Gateway Protocol (BGP) Machie learig BGP feature extractio ad selectio Support vector machie ad kerels Experimetal procedure ad classificatio results Coclusios ad refereces ISCAS 2018, Florece, Italy 3

4 Itroductio: Border Gateway Protocol BGP s mai fuctio is to optimally route data betwee Autoomous Systems (ASes) AS: a collectio of BGP routers (peers) withi a sigle admiistrative domai Four types of BGP messages: ope, keepalive, update, ad otificatio BGP aomalies: Slammer, Nimda, Code Red I, routig miscofiguratios ISCAS 2018, Florece, Italy 4

5 Itroductio: Machie learig Machie learig models classify data usig a feature matrix Feature matrix: rows: data poits colums: feature values Algorithms: Logistic Regressio, Naïve Bayes, Support Vector Machie (SVM) SVM defies decisio boudary to geometrically lie midway betwee the support vectors ISCAS 2018, Florece, Italy 5

6 Roadmap Itroductio Border Gateway Protocol (BGP) Machie learig BGP feature extractio ad selectio Support vector machie ad kerels Experimetal procedure ad classificatio results Coclusios ad refereces ISCAS 2018, Florece, Italy 6

7 Feature extractio: BGP messages Extract 37 features Sample every miute durig a five-day period: the peak day of a aomaly two days prior ad two days after the peak day 7,200 samples for each aomalous evet: 5,760 regular samples (o-aomalous) 1,440 aomalous samples imbalaced dataset ISCAS 2018, Florece, Italy 7

8 BGP features Feature Defiitio Category 1 Number of aoucemets Volume 2 Number of withdrawals Volume 3 Number of aouced NLRI prefixes Volume 4 Number of withdraw NLRI prefixes Volume 5 Average AS-PATH legth AS-path 6 Maximum AS-PATH legth AS-path 7 Average uique AS-PATH legth AS-path 8 Number of duplicate aoucemets Volume 9 Number of duplicate withdrawals Volume 10 Number of implicit withdrawals Volume ISCAS 2018, Florece, Italy 8

9 BGP features Feature Defiitio Category 11 Average edit distace AS-path 12 Maximum edit distace AS-path 13 Iter-arrival time Volume Maximum edit distace =, where = (7,..., 17) Maximum AS-path legth =, where = (7,..., 15) AS-path AS-path 34 Number of IGP packets Volume 35 Number of EGP packets Volume 36 Number of icomplete packets Volume 37 Packet size (B) Volume ISCAS 2018, Florece, Italy 9

10 Feature extractio: BGP messages Border Gateway Protocol (BGP) eables exchage of routig iformatio betwee gateway routers usig update messages Collectios of BGP update message: Réseaux IP Europées (RIPE) uder the Routig Iformatio Service (RIS) project Route Views Available i multi-threaded routig toolkit (MRT) biary format ISCAS 2018, Florece, Italy 10

11 BGP aomalies Slammer: ifected Microsoft SQL servers through a small piece of code that geerated IP addresses at radom Nimda: exploited vulerabilities i the Microsoft Iteret Iformatio Services (IIS) web servers for Iteret Explorer 5 Code Red I: attacked Microsoft IIS web servers by replicatig itself through IIS server weakesses ISCAS 2018, Florece, Italy 11

12 Duratio of BGP evets Aomaly Date Aomaly (mi) Regular (mi) Slammer Jauary 25, ,331 Nimda September 18-20, ,521 3,679 Code Red I July 19, ,600 ISCAS 2018, Florece, Italy 12

13 Number of BGP aoucemets: Slammer ISCAS 2018, Florece, Italy 13

14 Number of BGP aoucemets: Nimda ISCAS 2018, Florece, Italy 14

15 Number of BGP aoucemets: Code Red I ISCAS 2018, Florece, Italy 15

16 Number of BGP aoucemets: Regular ISCAS 2018, Florece, Italy 16

17 Roadmap Itroductio Border Gateway Protocol (BGP) Machie learig Feature extractio ad selectio Support vector machie ad kerels Experimetal procedure ad classificatio results Coclusios ad refereces ISCAS 2018, Florece, Italy 17

18 Feature selectio Reduces redudacy amog features ad improves the classificatio accuracy Decisio tree algorithm was used for for feature selectio: oe of the most successful techiques for supervised classificatio learig It ca hadle both umerical ad categorical features Publicly available software tool: C5 ISCAS 2018, Florece, Italy 18

19 Feature selectio: decisio tree Dataset Traiig data Selected features Dataset 1 Slammer + Nimda 1 21, 23 29, Dataset 2 Slammer + Code Red I 1 22, 24 29, Dataset 3 Code Red I + Nimda 1 29, Either four (30, 31, 32, 33) or five (22, 30, 31, 32, 33) features are removed i the costructed trees maily because: features are umerical ad some are used repeatedly ISCAS 2018, Florece, Italy 19

20 Roadmap Itroductio Border Gateway Protocol (BGP) Machie learig Feature extractio ad selectio Support vector machie ad kerels Experimetal procedure ad classificatio results Coclusios ad refereces ISCAS 2018, Florece, Italy 20

21 Support Vector Machie SVM defies a separatig hyperplae i order to assig the target variables ito distict categories It is a o-probabilistic biary classifier Used for classificatio problems ad i patter recogitio applicatios Modified versio of logistic regressio ISCAS 2018, Florece, Italy 21

22 Support Vector Machie For a give dataset x with umber of traiig data, SVM fids the maximum margi hyperplae separatig differet classes of data:! =! #, % #,! # ' (, % # 1, 1,, = 1,2,, /! # : p-dimesioal iput vector % # : output value (1 or -1) Decisio vector separatig two classes is give by: 1 2 3! + 5 = : optimal weighig vector b: bias ISCAS 2018, Florece, Italy 22

23 Support Vector Machie For liearly separable traiig data, margis are defied as:! " # $ + & = 1! " # $ + & = 1 ISCAS 2018, Florece, Italy 23

24 Support Vector Machie SVM with liear kerel: correctly classified regular (circles) ad aomalous (stars) data poits as well as oe icorrectly classified regular (circle) data poit ISCAS 2018, Florece, Italy 24

25 Support Vector Machie Distace betwee the margis: 2/ $ % Objective fuctio: miimize $ % Let C be the regularizatio parameter that defies the separatio of two classes ad the error whe usig a traiig dataset. The hyperplae is acquired by miimizig the margis: ( & ' ()* + ( /, with costraits 1 ( 2 3 ( 1 + (, 6 = 1,, 9 1 ( : target value + ( : set of slack variables ISCAS 2018, Florece, Italy 25

26 Support Vector Machie: kerel trick Istead of calculatig each mappig, the kerel trick is used to directly calculate the ier product i the iput space The mappig defies feature space ad geerates a decisio boudary for iput data poits Usig the kerel trick reduces the complexity of the optimizatio problem that ow oly depeds o the iput space istead if the feature space ISCAS 2018, Florece, Italy 26

27 Support Vector Machie Istead of employig a miimizatio model, the problem be formulated usig Lagragia dual multiplier! as: & max % subject to: &'(,! & 1 2 % &'(, % -'(! &! -. &. - / &, / -, 0! = 1,2,, 9 ad %! 3. 3 = 0 & 3'( ISCAS 2018, Florece, Italy 27

28 Support Vector Machie SVM with the oliear kerel fuctio: the three-dimesioal space shows a hyperplae dividig regular (circles) ad aomalous (stars) data poits ISCAS 2018, Florece, Italy 28

29 Roadmap Itroductio Border Gateway Protocol (BGP) Machie learig Feature extractio ad selectio Support vector machie ad kerels Experimetal procedure ad classificatio results Coclusios ad refereces ISCAS 2018, Florece, Italy 29

30 Experimetal procedure Step 1: Use 37 features or select the most relevat features usig the decisio tree algorithm Step 2: Trai the SVM with liear, quadratic, or cubic kerels Step 3: Test the models usig various datasets Step 4: Evaluate the SVM kerels based o accuracy ad F-Score ISCAS 2018, Florece, Italy 30

31 Traiig ad test datasets Traiig dataset Test dataset Dataset 1 Slammer ad Nimda Code Red I Dataset 2 Nimda ad Code Red I Slammer ISCAS 2018, Florece, Italy 31

32 Experimetal procedure MATLAB 2017b Statistics ad Machie Learig Toolbox The performace of SVM with various kerels is evaluated usig combiatios of datasets SVM performace was measured based o accuracy ad F-Score The cofusio matrix is used to evaluate performace of classificatio algorithms True positive (TP) ad false egative (FN) are the umber of aomalous data poits that are classified as aomaly ad regular, respectively ISCAS 2018, Florece, Italy 32

33 Performace measures Accuracy: (TP+TN)/(TP+TN+FP+FN) F-Score sigifies harmoic mea betwee precisio ad sesitivity: 2 x (precisio x sesitivity)/(precisio + sesitivity) precisio: TP/(TP+FP) sesitivity: TP/(TP+FN) ISCAS 2018, Florece, Italy 33

34 SVM with liear kerel Liear kerel Accuracy (%) F-Score (%) Selected features , 23-29, Traiig dataset Test RIPE BCNET Test Dataset Dataset Dataset Dataset ISCAS 2018, Florece, Italy 34

35 SVM with oliear kerels Quadratic kerel Accuracy (%) F-Score (%) Selected features , 23-29, Traiig dataset Test RIPE BCNET Test Dataset Dataset Dataset Dataset ISCAS 2018, Florece, Italy 35

36 SVM with oliear kerels Cubic kerel Accuracy (%) F-Score (%) Selected features , 23-29, Traiig dataset Test RIPE BCNET Test Dataset Dataset Dataset Dataset ISCAS 2018, Florece, Italy 36

37 Roadmap Itroductio Border Gateway Protocol (BGP) Machie learig Feature extractio ad selectio Support vector machie ad kerels Experimetal procedure ad classificatio results Coclusios ad refereces ISCAS 2018, Florece, Italy 37

38 Coclusios SVM algorithm is oe of the most efficiet ML tools Kerels are used to trasform the iput data ito a high dimesioal space Their performace depeds o both the feature selectio ad the type of datasets Aalyzed BGP aomaly datasets are liearly separable SVM with liear kerel outperforms SVMs with quadratic ad cubic kerels ISCAS 2018, Florece, Italy 38

39 Refereces: sources of data RIPE RIS raw data [Olie]. Available: Uiversity of Orego Route Views project [Olie]. Available: BCNET [Olie]. Available: ISCAS 2018, Florece, Italy 39

40 Refereces: Q. Dig, Z. Li, S. Haeri, ad Lj. Trajković, Applicatio of machie learig techiques to detectig aomalies i commuicatio etworks: Datasets ad Feature Selectio Algorithms i Cyber Threat Itelligece, M. Coti, A. Dehghataha, ad T. Dargahi, Eds., Berli: Spriger, to appear. Q. Dig, Z. Li, S. Haeri, ad Lj. Trajković, Applicatio of machie learig techiques to detectig aomalies i commuicatio etworks: Classificatio Algorithms i Cyber Threat Itelligece, M. Coti, A. Dehghataha, ad T. Dargahi, Eds., Berli: Spriger, to appear. Q. Dig, Z. Li, P. Batta, ad Lj. Trajković, "Detectig BGP aomalies usig machie learig techiques," i Proc. IEEE Iteratioal Coferece o Systems, Ma, ad Cyberetics (SMC 2016), Budapest, Hugary, Oct. 2016, pp Y. Li, H. J. Xig, Q. Hua, X.-Z. Wag, P. Batta, S. Haeri, ad Lj. Trajković, Classificatio of BGP aomalies usig decisio trees ad fuzzy rough sets, i Proc. IEEE Iteratioal Coferece o Systems, Ma, ad Cyberetics, SMC 2014, Sa Diego, CA, October 2014, pp N. Al-Rousa, S. Haeri, ad Lj. Trajković, Feature selectio for classificatio of BGP aomalies usig Bayesia models," i Proc. Iteratioal Coferece o Machie Learig ad Cyberetics, ICMLC 2012, Xi'a, Chia, July 2012, pp N. Al-Rousa ad Lj. Trajković, Machie learig models for classificatio of BGP aomalies, i Proc. IEEE Cof. High Performace Switchig ad Routig, HPSR 2012, Belgrade, Serbia, Jue 2012, pp ISCAS 2018, Florece, Italy 40

Communication Networks: Traffic Data, Network Topologies, and Routing Anomalies

Communication Networks: Traffic Data, Network Topologies, and Routing Anomalies Commuicatio Networks: Traffic Data, Network Topologies, ad Routig Aomalies Ljiljaa Trajković ljilja@cs.sfu.ca Commuicatio Networks Laboratory http://www.esc.sfu.ca/cl School of Egieerig Sciece Simo Fraser