Generating Labeled Training Datasets Towards Unified Network Intrusion Detection Systems

It is crucial to implement innovative artificial intelligence (AI)-powered network intrusion detection systems (NIDSes) to protect enterprise networks from cyberattacks, which have recently become more diverse and sophisticated. High-quality labeled training datasets are required to train AI-powered...

Full description

Saved in:
Bibliographic Details
Published in:IEEE access 2022, Vol.10, p.53972-53986
Main Authors: Ishibashi, Ryosuke, Miyamoto, Kohei, Han, Chansu, Ban, Tao, Takahashi, Takeshi, Takeuchi, Jun'ichi
Format: Article
Language:English
Subjects:
Artificial intelligence
Cybersecurity
Data models
Datasets
Feature extraction
Intrusion detection systems
IP networks
Labels
Network intrusion detection
Network intrusion detection system
packet data analysis
packet replay
public dataset
Reproducibility
Reproducibility of results
Security
security alert
security data labeling
Software
Software development tools
Training
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:It is crucial to implement innovative artificial intelligence (AI)-powered network intrusion detection systems (NIDSes) to protect enterprise networks from cyberattacks, which have recently become more diverse and sophisticated. High-quality labeled training datasets are required to train AI-powered NIDSes; such datasets are globally scarce, and generating new training datasets is considered cumbersome. In this study, we investigate the possibility of an approach that integrates the strengths of existing security appliances to generate labeled training datasets that can be leveraged to develop brand-new AI-powered cybersecurity solutions. We begin by locating communication flows that the deployed NIDSes detect as suspicious, investigating their causal factors, and assigning appropriate labels in a universal format. Then, we output the packet data in the identified communication flows and the corresponding alert-type labels as labeled data. We demonstrate the effectiveness of the labeling scheme by evaluating classification models trained with the labeled dataset we generated. Furthermore, we provide case studies to examine the performance of several commonly used NIDSes and on practical approaches to automating the security triage process. Labeled datasets in this study are generated using public datasets and open-source NIDSes to ensure the reproducibility of the results. The datasets and the software tools are made publicly accessible for research use.
ISSN:2169-3536
2169-3536
DOI:10.1109/ACCESS.2022.3176098