Network traffic anomaly prediction using Artificial Neural Network

Transcription

1 Network traffic anomaly prediction using Artificial Neural Network Hening Titi Ciptaningtyas, Chastine Fatichah, and Altea Sabila Citation: AIP Conference Proceedings 1818, (2017); View online: View Table of Contents: Published by the American Institute of Physics Articles you may be interested in Evaluation of bolted connections in wood-plastic composites AIP Conference Proceedings 1818, (2017); / Technical skills requirement of Indonesian construction labors to work in Malaysia AIP Conference Proceedings 1818, (2017); / Factors on green service industry: Case study at AirAsia AIP Conference Proceedings 1818, (2017); / A study on the static and impact structural behavior of concrete filled steel tubular members under Tsunami flotsam collision AIP Conference Proceedings 1818, (2017); / An application of traveling salesman problem using the improved genetic algorithm on android google maps AIP Conference Proceedings 1818, (2017); / Competence assessment for vocational school students based on business and industry chamber to improve graduate entrepreneurship AIP Conference Proceedings 1818, (2017); /

2 Network Traffic Anomaly Prediction Using Artificial Neural Network Hening Titi Ciptaningtyas 1, a) Chastine Fatichah 2, Altea Sabila 3 1,2,3 Department of Informatics, Faculty of Information Technology, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia a) Corresponding author: henning.its@gmail.com Abstract.As the excessive increase of internet usage, the malicious software (malware) has also increase significantly. Malware is software developed by hacker for illegal purpose(s), such as stealing data and identity, causing computer damage, or denying service to other user[1]. Malware which attack computer or server often triggers network traffic anomaly phenomena. Based on Sophos s report[2], Indonesia is the riskiest country of malware attack and it also has high network traffic anomaly. This research uses Artificial Neural Network (ANN) to predict network traffic anomaly based on malware attack in Indonesia which is recorded by Id-SIRTII/CC (Indonesia Security Incident Response Team on Internet Infrastructure/Coordination Center). The case study is the highest malware attack (SQL injection) which has happened in three consecutive years: 2012, 2013, and 2014[4]. The data series is preprocessed first, then the network traffic anomaly is predicted using Artificial Neural Network and using two weight update algorithms: and. Error of prediction is calculated using (MSE) [7]. The experimental result shows that MSE for SQL Injection is 856. So, this approach can be used to predict network traffic anomaly. INTRODUCTION As the excessive increase of internet usage, the malicious software (malware) has also increase significantly. Malware is software developed by hacker for illegal purpose(s), such as stealing data and identity, causing computer damage, or denying service to other user [1]. Malware attacking computer or server often triggers network traffic anomaly phenomena [2]. Based on Sophos s report, Indonesia is the riskiest country of malware attack and it also has high network traffic anomaly. Indonesia has 23.54% Threat Exposure Rate (TER), which means 23.54% of computer in Indonesia has been infected by Malware [3]. Security on the computer network system can be interpreted as an attempt to make the protection of data and resources from unauthorized access, vandalism and malfunction. The computer network is a valuable asset that must be protected, both physical and non-physical [4]. The traffic network anomaly data focused on SQL Injection attack which obtained from ID-SIRTII / CC (Indonesia Security Incident Response Team on Internet Infrastructure/Coordination Center) research data in three consecutive year: 2012, 2013 and 2014 [5]. It forms time series data which organized by time, has random value and statistically interconnected [6]. This research tries to forecast the amount of network traffic anomaly data in the future. Forecasting is a process to predict events or changes in the future. Time series model is often associated with the process of forecasting a value of particular characteristics in the next period, controlling a process or to identify patterns of behavior of the system. There are various ways in predicting the time series data, such as Backpropagation, Hybrid, Artificial Neural Networks, Fuzzy and Genetic algorithm. In this study, we use Artificial Neural Network (ANN). ANN has been widely implemented in various scientific fields to make predictions or forecasting since 1940 and has become an interesting object of research [7]. ANN is a mathematical model of the structure and function inspired by the organization and function of the human brain. ANN can handle nonlinear data, more tolerance to noise ratio of the system, and tend to produce lower prediction error. ANN with the type of Feed-Forward Network Engineering International Conference (EIC) 2016 AIP Conf. Proc. 1818, ; doi: / Published by AIP Publishing /$

3 or Backpropagation has proven to give good results for prediction [8]. While other research is detecting network traffic anomaly, this research is forecasting network traffic anomaly based on previous time series data. This research objective is to forecast the amount of network traffic anomaly data in the future. If the attack can be predicted, then network traffic anomalies can be avoided. METHODOLOGY This research tries to predict the amount of network traffic anomaly data which is caused by SQL Injection. Data is processed using Artificial Neural Network (ANN), the output is data prediction and (MSE) of the data testing. In this study, there are two training which updates the weights using and. Network Traffic Anomaly Network traffic anomaly is aberration of computer system or computer network which is caused by security incident. It also caused by violation and threat to computer security policy, legal use policy and security standard practices [9]. SQL injection is a technique that exploits a security vulnerability occurring in the database layer of an application and CGI layer [10] [11]. Data Time Series Time series data is a type of observational data that consists of one object but includes some period of time, for example daily, weekly, monthly, yearly in which the observational data were random and statistically interconnected. Time series analysis is used to perform data analysis such as predicting future events since it is believed that a pattern in the past will happen again in the future [6]. Pre-processing Data pre-processing stage try to prepare the data before it is processed further by a method [12]. In this study there are two kind of pre-processing: 1. Data Imputation process Missing value or an empty value is information that is not available to a subject or case. It is occurred because the information about the object is not given, difficult to find or does not exist. 2. Data Normalization Data normalization tries to unify the data interval. Uniformity of data affects the calculation of the matrices in the data. Artificial Neural Network (ANN) Artificial Neural Network (ANN) is a model based on the human brain. ANN consists of a number of very simple and interconnected processors called neurons [13]. Neurons are connected by weighting pass signals from one neuron to other [14] as in Fig.1. ANN model has equation formula (1) where n j is the j neuron from output layer of neural network, n i is the i neuron from input layer of neural network, w ij is the weight between i neuron from input layer and j neuron from output layer (weight score between 1 dan +1), b j is the j bias (Bias score is -1 or +1), and w j is the j bias weight. (1) Error Calculation This calculation is to measure the accuracy of prediction. There are three types of error calculations: Mean Squared Error (MSE), Mean Absolute Error (MAE) and Mean Absolute Percentage Error (MAPE) [15]. This

4 research use MSE since it gives good illustration of model consistency. MSE has equation (2) where is neuron output of neural network method, is target value and is neuron output number. (2) Output Y Output Layer Weight w2 Hidden Layer Weight w1 Input Layer Input X The flow diagram of the process is shown in Fig. 2. Start FIGURE 1. Multilayer Network Architecture DESIGN AND IMPLEMENTATION Input Data (IdSIRTII data) Testing Preprocessing MSE Training Output Data Finish FIGURE 2.Flow Process Input Data The input data is data to be processed by the system to obtain a predetermined output system. In this application, the dataset is the ID-SIRTII/CC research data on network traffic anomaly in three consecutive years: 2012, 2013 and

5 2014. The data training is 2012 and 2013 data, while the data testing is 2014 data. Each training and testing input data has five features (data for five days) and data target is the next data (sixth day). Any blank data will be filled in pre-processing stage by filling missing value and normalizing data. Data imputation is done manually and normalization is done using MATLAB 2015a. Pre-processing There are 2 steps for pre-processing data: Data Imputation and Data Normalization. Data Imputation There are several ways in data imputation process if there is empty or missing value in the data. In this research, we used four types data imputation process to fill out a missing value on a dataset: First, using cumulative average of the four previous data where missing value in the middle of the data is filled with the average of four data above. The upper limit and lower limit of data testing is removed since it is not available. Second, using cumulative average of the four previous data where missing value in the middle of the data and lower limit of the data testing is filled with the average of four nominal above. The upper limit of data testing removed since it is not available Third, using cumulative average of the four previous data where missing value in the middle of the data and lower limit of the data testing is filled with the average of four nominal above. The upper limit of data testing is filled with the top nominal of the dataset. Fourth, using cumulative average of the four previous data where missing value in the middle of the data and lower limit of the data testing is filled with the average of four nominal above. The upper limit of data testing is filled with the average of the whole dataset. Data Normalization There are few methods for data normalization. In this research, we used Min-Max normalization method. In the Min-Max normalization, if MinA and maxa are the value of minimum and maximum value of the attributes A, Min- Max normalization maps a value v of A to v' in the range [new_mina, new_maxa] with equation (3) where v is Dataset, v is Min-Max normalization result, mina is minimum score of A and maxa is maximum score of A. (3) Artificial Neural Network (ANN) Artificial Neural Network (ANN) model is adaptable model and often used to compare each prediction possibility. These are important things to consider in designing ANN model to predict the amount of network traffic anomaly data: 1. The number of input neurons: This number is determined based on the database. In this research, number of neurons is 5 based on the feature number. 2. The number of hidden layer: The number of hidden layer neuron depends on the number of inputs and property data. In general and in this research, the number of hidden layer used is one only. 3. The number of hidden neurons: A commonly used technique in determining the number of hidden neurons is calculated experimentally. In this research, the number of hidden neurons tested based on the determined scenario. So, the number of hidden neurons can be changed dynamically. 4. The number of output neurons: Generally, ANN application and research for predictions use one neuron output. 5. Activation Function: Activation functions are used to determine the output of processed neurons. Mechanical activation function used in this study is sigmoid activation function

6 Training Training on Artificial Neural Network (ANN) includes an iterative process of the input data so the appropriate network and can be used for prediction. The purpose of training is to minimize the error, which indicates that the ANN model is in conformity with the input. In backpropagation there are two major ways of learning rate and update the weights. Learning rate determines how fast the neural networks learn patterns from the training data. This value must be chosen correctly, if it is too small then the learning process will be long and if it is too large, there will be deviations. While the updated weight shows that the weights of the previous iteration affect current weight. In this research, updating the weights is using and momentum. They will be tested on some predefined scenarios. The back propagation algorithm for training[16] is as follows: 1. Start with a set of training data input and output targets. 2. Initialize all network weights with a few small figures random value. 3. For each set of data input, entry the input to the neural network and calculate the output. 4. Compare the results of the network output to the target output and calculate the error. 5. Change the network weight to lower the error, and repeat the process. Those steps can be executed in two ways. First, calculate the error, change the weights for each input and output data target, and move to the next data set. Second, calculate the cumulative error of all input and output data target, then replace the weights and repeat the process. Steps 1 to 3 at the back propagation algorithm is a straightforward step, therefore, steps 4 and 5 will be discussed further in the following paragraph. There are two kinds of training, backpropagation with and. The formula of propagation by is as equation (4) and equation (5) where is the updated hidden weight, is the old hidden weight that is not optimal, is the updated output weight, is the old output weight that is not optimal, is the hidden prediction score, is the output prediction score, is the learning rate (0.25 or 0.5), i s the score from hidden j, and is the score from neuron i. (4) (5) To change the weight is by adding the old weights with. However, the weight of the previous iteration gives major influence on the performance of the neural network. So, it is added to the old weight multiplied by as equation (6) and equation (7) where is the updated hidden weight, is the current hidden weight, is the previous hidden weight, is the updated output weight, is the current output weight, is the previous output weight, is the hidden prediction score, is the output prediction score, is the learning rate (0.25 or 0.5), is the score from hidden j, is the score from neuron I, is the factor (0.5). (6) (7) Testing Artificial Neural Network (ANN) testing aim is to get the predicted results with the parameters obtained from the most optimal training process. Here is the algorithm for testing which have stages like training but without updating the weights [17] 1. Begin testing with a set of input data and output targets. 2. Initialize all network weights with final weights value of the training process which is the most optimum weight. 3. With each set of data input, entry the input data to the neural network and calculate the output

7 4. Compare the results of the network output to the target output and calculate the error. Error Calculation The result of calculation error is not only to determine whether the output is right or wrong, but also to determine the degree of truth or falsity. In this research, we used MSE. RESULTS AND DISCUSSION This experiment tries to obtain the lowest error value. ANN parameter in this experiment can be seen in Table 1. Several scenarios trials that will be conducted as follows: 1. Comparing the results of the MSE data network traffic anomaly prediction in one year. 2. Comparing the results of the MSE data network traffic anomaly prediction in three months. 3. Comparing the results of the MSE data network traffic anomaly prediction in one month. TABLE 1.Artificial Neural NetworkParameter Parameter Description Input layer Network traffic anomalies (5 Features): SQL Injection Hidden Neuron 2 4 neuron Learning rate Activation Function Sigmoid Error (MSE) Output layer Prediction of network traffic anomalies 0.5 Scenario 1 Scenario 1 is comparing the results of the MSE data network traffic anomaly prediction in one year. Parameter in Scenario 1 is described intable 1. The difference between scenario 1.1, 1.2, 1.3, and 1.4 is the data imputation process. Scenario 1.1 using the first data imputation, scenario 1.2 using second data imputation, and so on. The MSE result of Scenario 1.1 can be seen in Fig. 3, Scenario 1.2 can be seen in Fig. 4, Scenario 1.3 can be seen in Fig. 5, and Scenario 1.4 can be seen in Fig.6. The comparison of real data, prediction error value using, and is shown in Fig. 7. The best value of each scenario can be seen in Table 2. TABLE 2. Scenario 1 Experimental Result Missing Value Hidden Neuron Scenario Scenario Scenario Scenario

8 (a) (b) (c) FIGURE 3. Experimental Result Scenario 1.1 (a) Hidden Neuron 2; (b) Hidden Neuron 3; (c) Hidden Neuron

9 (a) (b) 0.07 (c) FIGURE 4. Experimental Result Scenario 1.2 (a) Hidden Neuron 2; (b) Hidden Neuron 3; (c) Hidden Neuron

10 (a) (b) (c) FIGURE 5.Experimental Result Scenario 1.3 (a) Hidden Neuron 2; (b) Hidden Neuron 3; (c) Hidden Neuron

11 (a) (b) (c) FIGURE 6. Experimental Result Scenario 1.4 (a) Hidden Neuron 2; (b) Hidden Neuron 3; (c) Hidden Neuron

12 FIGURE 7. First Scenario: Comparison of Real Data, and Scenario 2 Scenario 2 is comparing the results of the MSE data network traffic anomaly prediction in three months. Parameter in Scenario 2 is described in Table 1. The comparison of real data, prediction error value using, and is shown in Fig. 8. The MSE result of Scenario 2 can be seen in Fig. 9. The best value for Scenario 2 is using 0.1, Hidden Neuron 2, Gradien Descent and FIGURE 8. Second Scenario: Comparison of Real Data, and

13 (a) (b) (c) FIGURE 9. Experimental Result Scenario 2 (a) Hidden Neuron 2; (b) Hidden Neuron 3; (c) Hidden Neuron

14 Scenario 3 Scenario 3 is comparing the results of the MSE data network traffic anomaly prediction in three months. Parameter in Scenario 3 is described in Table 1. The comparison of real data, prediction error value using Gradient Descent, and is shown in Fig. 10. The MSE result of Scenario 3 can be seen in Fig.11. The best value for Scenario 3 is using 0.1, Hidden Neuron 2, Gradien Descent and FIGURE 10. Second Scenario: Comparison of Real Data, and

15 (a) (b) (c) (d) FIGURE 11. Experimental Result Scenario 3 (a) Hidden Neuron 2; (b) Hidden Neuron 3; (c) Hidden Neuron 4 CONCLUSION From the experimental result, it can be concluded as follows: The most optimal way to fill a missing parameter value is by using cumulative average of the four previous data where missing value in the middle of the data, the lower limit of the data testing is filled with the average of four nominal above, and the upper limit of data testing is filled with the average of the whole dataset. The lowest MSE result is Scenario 1 where the prediction is made for a year. Artificial Neural Networks (ANN) method can yield good predictions for traffic network anomaly (SQL Injection attack) by using learning rate 0.1 and hidden neurons 2. The lowest MSE for update weights is 893 and for update weights is

16 ACKNOWLEDGMENTS We would like to thank the Ministry of Research and Higher Education (Kemenristekdikti) for financial support during this study. This research was financed according to Research Implementation Letter of Agreement No / IT2.11 / PN.08 / REFERENCES 1. M. Masud, L. Khan and B. Thuraisingham, Data Mining Tools for Malware Detection, Boca Raton: CRC Press, M. Jakobsson and Z. Ramzan, Crimeware : Understanding New Attacks and Defenses, California: symantec. press, Sophos, "Security Threat Report 2013," Sophos, J. P. Anderson, Computer Security Threat Monitoring and Surveillance, Washington: James P. Anderson Co., Id-SIRTII/CC, "Id-SIRTII/CC," [Online]. Available: [Accessed 01 Desember 2015]. 6. J. D. Cryer, Time Series Analysis, Wadsworth Publ. Co,, J. Williams and Y. Li, "A Case Using Neural Network Algorithms: Horse Racing Predictions in Jamaica," in International Conf. on Artificial Intelligence (ICAI'08), Las Vegas, A. Lapedes and R. Farber, "How Neural Nets Work," in Evolution, Learning and Cognition, World Scientific, 1989, pp CSIRT, Panduan Penanganan Insiden Keamanan Jaringan, BPPT CSIRT, J. Clarke, "Testing for SQL Injection," in SQL Injection Attacks and Defense, Boston, Elsevier Inc., 2009, pp W. G. Halfond and A. Orso, AMNESIA: Analysis and Monitoring for Nuutralizing SQL-Injection, S. K. Patro and K. K. sahu, Normalization: A Preprocessing Stage, India: Department of CSE & IT, VSSUT, Burla, Odisha, India. 13. E. R. Jones, An Introduction to Neural Networks, San Ramon: Visual Numerics, O. Coupelon, Neural Network Modeling for Stock Market Prediction " State of the Art". 15. A. Saikhu, ""Time Series Forcasting"," Teknik Informatika, Fakultas Teknologi Informasi. Institute Teknologi Sepuluh November. 16. A. T. W. Utami and B. S. S. Ulama, JURNAL SAINS DAN SENI ITS, 4 (2) (2015). 17. D. M. Bourg and G. Seeman, "AI for Game Developer", O'Reilly Media,