Generating Labeled Training Datasets Towards Unified Network Intrusion Detection Systems

• Published in: IEEE access 2022, Vol.10, p.53972-53986
• Main Authors: Ishibashi, Ryosuke, Miyamoto, Kohei, Han, Chansu, Ban, Tao, Takahashi, Takeshi, Takeuchi, Jun'ichi
• Format: Article
• Language: English
• Subjects: Artificial intelligence; Cybersecurity; Data models; Datasets; Feature extraction; Intrusion detection systems; IP networks; Labels; Network intrusion detection; Network intrusion detection system; packet data analysis; packet replay; public dataset; Reproducibility; Reproducibility of results; Security; security alert; security data labeling; Software; Software development tools; Training
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2022.3176098

It is crucial to implement innovative artificial intelligence (AI)-powered network intrusion detection systems (NIDSes) to protect enterprise networks from cyberattacks, which have recently become more diverse and sophisticated. High-quality labeled training datasets are required to train AI-powered NIDSes; such datasets are globally scarce, and generating new training datasets is considered cumbersome. In this study, we investigate the possibility of an approach that integrates the strengths of existing security appliances to generate labeled training datasets that can be leveraged to develop brand-new AI-powered cybersecurity solutions. We begin by locating communication flows that the deployed NIDSes detect as suspicious, investigating their causal factors, and assigning appropriate labels in a universal format. Then, we output the packet data in the identified communication flows and the corresponding alert-type labels as labeled data. We demonstrate the effectiveness of the labeling scheme by evaluating classification models trained with the labeled dataset we generated. Furthermore, we provide case studies to examine the performance of several commonly used NIDSes and on practical approaches to automating the security triage process. Labeled datasets in this study are generated using public datasets and open-source NIDSes to ensure the reproducibility of the results. The datasets and the software tools are made publicly accessible for research use.