Deep abstraction and weighted feature selection for Wi-Fi impersonation detection

IEEE Transactions on Information Forensics and Security

Volumn 13, Issue 3, 2017, Pages 621-636

  Aminanto, Muhamad Erza ^a   Choi, Rakyong ^a   Tanuwidjaja, Harry Chandra ^a   Yoo, Paul D ^b   Kim, Kwangjo ^a  

^a Korea Advanced Institute of Science and Technology (KAIST)   (South Korea)

^b Centre for Electronic Warfare   (United Kingdom)

Author keywords

Deep learning; Feature extraction; Impersonation attack; Intrusion detection system; Large scale Wi Fi networks; Stacked autoencoder

Indexed keywords

CLUSTERING ALGORITHMS; DEEP LEARNING; EXTRACTION; INTRUSION DETECTION; LEARNING SYSTEMS; SUPPORT VECTOR MACHINES; WI-FI; WIRELESS LOCAL AREA NETWORKS (WLAN); WIRELESS NETWORKS;

COMPUTATIONAL MODEL; IMPERSONATION ATTACK; INTRUSION DETECTION SYSTEMS; SECURITY; STACKED AUTOENCODER; WI FI NETWORKS; WIRELESS FIDELITIES;

FEATURE EXTRACTION;

EID: 85045420000     PISSN: 15566013     EISSN: None     Source Type: Journal    
DOI: 10.1109/TIFS.2017.2762828     Document Type: Article

References (71)

1. A. Osseiran et al., "Scenarios for 5G mobile and wireless communications: The vision of the METIS project", IEEE Commun. Mag., vol. 52, no. 5, pp. 26-35, May 2014.
2. C. Kolias, A. Stavrou, J. Voas, I. Bojanova, and R. Kuhn, "Learning Internet-of-Things security 'hands-on'", IEEE Security Privacy, vol. 14, no. 1, pp. 37-46, Jan./Feb. 2016.
3. C. Kolias, G. Kambourakis, and M. Maragoudakis, "Swarm intelligence in intrusion detection: A survey", Comput. Secur., vol. 30, no. 8, pp. 625-642, 2011.
4. A. G. Fragkiadakis, V. A. Siris, N. E. Petroulakis, and A. P. Traganitis, "Anomaly-based intrusion detection of jamming attacks, local versus collaborative detection", Wireless Commun. Mobile Comput., vol. 15, no. 2, pp. 276-294, 2015.
5. R. Sommer and V. Paxson, "Outside the closed world: On using machine learning for network intrusion detection", in Proc. IEEE Symp. Secur. Privacy, Berkeley, CA, USA, May 2010, pp. 305-316.
6. G. Anthes, "Deep learning comes of age", Commun. ACM, vol. 56, no. 6, pp. 13-15, 2013.
7. A. H. Farooqi and F. A. Khan, "Intrusion detection systems for wireless sensor networks: A survey", in Proc. Future Generat. Inf. Technol. Conf., Jeju Island, South Korea, 2009, pp. 234-241.
8. I. Butun, S. D. Morgera, and R. Sankar, "A survey of intrusion detection systems in wireless sensor networks", IEEE Commun. Surveys Tuts., vol. 16, no. 1, pp. 266-282, 1st Quart., 2014.
9. R. Mitchell and I.-R. Chen, "Behavior rule specification-based intrusion detection for safety critical medical cyber physical systems", IEEE Trans. Depend. Sec. Comput., vol. 12, no. 1, pp. 16-30, Jan. 2015.
10. A. Meshram and C. Haas, "Anomaly detection in industrial networks using machine learning: A roadmap", in Machine Learning for Cyber Physical Systems, Karlsruhe, Germany: Springer, 2017, pp. 65-72.
11. H. Motoda and H. Liu, "Feature selection, extraction and construction", in Proc. Inst. Inf. Comput. Commun. (IICM), vol. 5. 2002, pp. 67-72.
12. J. Zhang, X. Hu, P. Li, W. He, Y. Zhang, and H. Li, "A hybrid feature selection approach by correlation-based filters and SVM-RFE", in Proc. IEEE Pattern Recognit. (ICPR), Stockholm, Sweden, Aug. 2014, pp. 3684-3689.
13. C. Thomas and N. Balakrishnan, "Improvement in intrusion detection with advances in sensor fusion", IEEE Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 542-551, Sep. 2009.
14. W. Wang, X. Wang, D. Feng, J. Liu, Z. Han, and X. Zhang, "Exploring permission-induced risk in Android applications for malicious application detection", IEEE Trans. Inf. Forensics Security, vol. 9, no. 11, pp. 1869-1882, Nov. 2014.
15. C. Kolias, G. Kambourakis, A. Stavrou, and S. Gritzalis, "Intrusion detection in 802.11 networks: Empirical evaluation of threats and a public dataset", IEEE Commun. Surveys Tuts., vol. 18, no. 1, pp. 184-208, 1st Quart., 2016.
16. V. Shah and A. K. Aggarwal, "Enhancing performance of intrusion detection system against KDD99 dataset using evidence theory", Int. J. Cyber-Secur. Digit. Forensics, vol. 5, no. 2, pp. 106-114, 2016.
17. H. Bostani and M. Sheikhan, "Modification of supervised OPF-based intrusion detection systems using unsupervised learning and social network concept", Pattern Recognit., vol. 62, pp. 56-72, Feb. 2017.
18. C. Kolias, V. Kolias, and G. Kambourakis, "TermID: A distributed swarm intelligence-based approach for wireless intrusion detection", Int. J. Inf. Secur., vol. 16, no. 4, pp. 401-416, 2017.
19. H. G. Kayacik, A. N. Zincir-Heywood, and M. I. Heywood, "Selecting features for intrusion detection: A feature relevance analysis on KDD 99 intrusion detection datasets", in Proc. Privacy, Secur. Trust, St. Andrews, NB, Canada, 2005, pp. 1-6.
20. S. Puthran and K. Shah, "Intrusion detection using improved decision tree algorithm with binary and quad split", in Proc. Secur. Comput. Commun., 2016, pp. 427-438.
21. N. Y. Almusallam, Z. Tari, P. Bertok, and A. Y. Zomaya, "Dimensionality reduction for intrusion detection systems in multi-data streams-A review and proposal of unsupervised feature selection scheme", Emergent Comput., vol. 24, pp. 467-487, 2017. [Online]. Available: https://doi.org/10.1007/978-3-319-46376-6-22
22. S. Zaman and F. Karray, "Lightweight IDS based on features selection and IDS classification scheme", in Proc. IEEE Comput. Sci. Eng. (CSE), Aug. 2009, pp. 365-370.
23. P. Louvieris, N. Clewley, and X. Liu, "Effects-based feature identification for network intrusion detection", Neurocomputing, vol. 121, pp. 265-273, Dec. 2013.
24. Y. Zhu, J. Liang, J. Chen, and Z. Ming, "An improved NSGA-III algorithm for feature selection used in intrusion detection", Knowl.-Based Syst., vol. 116, pp. 74-85, Jan. 2017.
25. V. Manekar and K. Waghmare, "Intrusion detection system using support vector machine (SVM) and particle swarm optimization (PSO)", Int. J. Adv. Comput. Res., vol. 4, no. 3, pp. 808-812, 2014.
26. H. Saxena and V. Richariya, "Intrusion detection in KDD99 dataset using SVM-PSO and feature reduction with information gain", Int. J. Comput. Appl., vol. 98, no. 6, pp. 25-29, 2014.
27. E. Schaffernicht and H.-M. Gross, "Weighted mutual information for feature selection", in Artificial Neural Networks and Machine Learning-ICANN. Espoo, Finland: Springer, 2011, pp. 181-188.
28. I. Guyon, J. Weston, S. Barnhill, and V. Vapnik, "Gene selection for cancer classification using support vector machines", Mach. Learn., vol. 46, nos. 1-3, pp. 389-422, 2002.
29. Z. Wang, "The applications of deep learning on traffic identification", in Proc. Conf. BlackHat, Las Vegas, NV, USA, 2015, pp. 1-10.
30. S. Aljawarneh, M. Aldwairi, and M. B. Yassein, "Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model", J. Comput. Sci., Mar. 2017. [Online]. Available: http://dx.doi.org/10.1016/j.jocs.2017.03.006
31. K. Huseynov, K. Kim, and P. D. Yoo, "Semi-supervised botnet detection using ant colony clustering", in Proc. Symp. Cryptogr. Inf. Secur. (SCIS), Kagoshima, Japan, 2014, pp. 1-7.
32. K.-M. Kim, H. Kim, and K. Kim, "Design of an intrusion detection system for unknown-attacks based on bio-inspired algorithms", in Proc. Comput. Secur. Symp. (CSS), Nagasaki, Japan, 2015, pp. 64-70.
33. M. E. Aminanto, H. Kim, K.-M. Kim, and K. Kim, "Another fuzzy anomaly detection system based on ant clustering algorithm", IEICE Trans. Fundam. Electron., Commun. Comput. Sci., vol. E100. A, no. 1, pp. 176-183, 2017.
34. H.-C. Shin, M. R. Orton, D. J. Collins, S. J. Doran, and M. O. Leach, "Stacked autoencoders for unsupervised feature learning and multiple organ detection in a pilot study using 4D patient data", IEEE Trans. Pattern Anal. Mach. Intell., vol. 35, no. 8, pp. 1930-1943, Aug. 2013.
35. M. Usha and P. Kavitha, "Anomaly based intrusion detection for 802.11 networks with optimal features using SVM classifier", Wireless Netw., vol. 22, no. 8, pp. 2431-2446, 2016.
36. M. E. Aminanto and K. Kim, "Detecting impersonation attack in WiFi networks using deep learning approach", in Proc. Workshop Inf. Secur. Appl. (WISA), Jeju Island, South Korea, 2016, pp. 136-147.
37. M. E. Aminanto, H. C. Tanuwidjaja, P. D. Yoo, and K. Kim, "Weighted feature selection techniques for detecting impersonation attack in Wi-Fi networks", in Proc. Symp. Cryptogr. Inf. Secur. (SCIS), Naha, Japan, 2017, pp. 1-8.
38. M. Barbeau, J. Hall, and E. Kranakis, "Detecting impersonation attacks in future wireless and mobile networks", in Proc. Secure Mobile Ad-Hoc Netw. Sensors, Singapore, 2006, pp. 80-95.
39. M. S. Ahmad and V. Ramachandran, "Cafe latte with a free topping of cracked WEP retrieving WEP keys from road warriors", in Proc. Conf. ToorCon, San Diego, CA, USA, 2007.
40. Aircrack-ng. (2010). Airbase-ng. Accessed: Dec. 12, 2016. [Online]. Available: http://www.aircrack-ng.org/doku.php?id=airbaseng#hirte-attack-in-acces% s-point-mode
41. R. Beyah, S. Kangude, G. Yu, B. Strickland, and J. Copeland, "Rogue access point detection using temporal traffic characteristics", in Proc. IEEE Conf. Global Telecommun. (GLOBECOM), vol. 4. Dallas, TX, USA, Nov./Dec. 2004, pp. 2271-2275.
42. L. Malisa, K. Kostiainen, M. Och, and S. Capkun, "Mobile application impersonation detection using dynamic user interface extraction", in Proc. Eur. Symp. Res. Comput. Secur. (ESORICS), Heraklion, Greece, 2016, pp. 217-237.
43. O. Goga, G. Venkatadri, and K. P. Gummadi, "The doppelgänger bot Attack: Exploring identity impersonation in online social networks", in Proc. ACM Internet Meas. Conf. (IMC), Tokyo, Japan, 2015, pp. 141-153.
44. T. Shang and L. Y. Gui, "Identification and prevention of impersonation attack based on a new flag byte", in Proc. IEEE Int. Conf. Comput. Sci. Netw. Technol. (ICCSNT), vol. 1. Harbin, China, Dec. 2015, pp. 972-976.
45. M. H. Yilmaz and H. Arslan, "Impersonation attack identification for secure communication", in Proc. IEEE Globecom Workshops (GC Wkshps), Atlanta, GA, USA, Dec. 2013, pp. 1275-1279.
46. I. B. Lakshmi, B. S. Lakshmi, and R. Karthikeyan, "Detection and prevention of impersonation attack in wireless networks", Int. J. Adv. Res. Comput. Sci. Technol., vol. 2, no. 1, pp. 267-270, 2014.
47. F. Palmieri, U. Fiore, and A. Castiglione, "A distributed approach to network anomaly detection based on independent component analysis", Concurrency Comput., Pract. Exper., vol. 26, no. 5, pp. 1113-1129, 2014.
48. Q. Xu, C. Zhang, L. Zhang, and Y. Song, "The learning effect of different hidden layers stacked autoencoder", in Proc. IEEE Int. Con. Intell. Hum.-Mach. Syst. Cybern. (IHMSC), vol. 2. Zhejiang, China, Aug. 2016, pp. 148-151.
49. H. Shafri and F. S. H. Ramle, "A comparison of support vector machine and decision tree classifications using satellite data of Langkawi Island", Inf. Technol. J., vol. 8, no. 1, pp. 64-70, 2009.
50. R. Rojas, "The backpropagation algorithm", in Neural Networks. Berlin, Germany: Springer, 1996, pp. 149-182.
51. B. A. Olshausen and D. J. Field, "Sparse coding with an overcomplete basis set: A strategy employed by V1?" Vis. Res., vol. 37, no. 23, pp. 3311-3325, 1997.
52. E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo, "A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data", Appl. Data Mining Comput. Secur., vol. 6, pp. 77-101, May 2002.
53. Y. Bengio, P. Lamblin, D. Popovici, and H. Larochelle, "Greedy layerwise training of deep networks", Adv. Neural Inf. Process. Syst., vol. 19, pp. 153-160, Sep. 2007.
54. Y. Bengio and Y. LeCun, "Scaling learning algorithms towards AI", Large-Scale Kernel Mach., vol. 34, no. 5, pp. 1-41, 2007.
55. L. Guerra, L. M. McGarry, V. Robles, C. Bielza, P. Larrañaga, and R. Yuste, "Comparison between supervised and unsupervised classifications of neuronal cell types: A case study", Develop. Neurobiol., vol. 71, no. 1, pp. 71-82, 2011.
56. M. F. Møller, "A scaled conjugate gradient algorithm for fast supervised learning", Neural Netw., vol. 6, no. 4, pp. 525-533, Nov. 1993.
57. X. Zeng, Y.-W. Chen, C. Tao, and D. van Alphen, "Feature selection using recursive feature elimination for handwritten digit recognition", in Proc. IEEE Intell. Inf. Hiding Multimedia Signal Process. (IIH-MSP), Kyoto, Japan, Sep. 2009, pp. 1205-1208.
58. C. A. Ratanamahatana and D. Gunopulos, "Scaling up the naive Bayesian classifier: Using decision trees for feature selection", in Proc. IEEE Workshop Data Cleaning Preprocess. (DCAP), IEEE Int. Conf. Data Mining (ICDM), Maebashi, Japan, Dec. 2002.
59. A. Özgür and H. Erdem, "A review of KDD99 dataset usage in intrusion detection and machine learning between 2010 and 2015", PeerJ PrePrints, vol. 4, p. e1954v1, Apr. 2016.
60. M. Hall, E. Frank, G. Holmes, B. Pfahringer, P. Reutemann, and I. H. Witten, "The WEKA data mining software: An update", ACM SIGKDD Explorations Newslett., vol. 11, no. 1, pp. 10-18, 2009.
61. M. Sabhnani and G. Serpen, "Application of machine learning algorithms to KDD intrusion detection dataset within misuse detection context", in Proc. Int. Conf. Mach. Learn., Models, Technol. Appl. (MLMTA), Lax Vegas, NV, USA, 2003, pp. 209-215.
62. D. T. Larose, Discovering Knowledge in Data: An Introduction to Data Mining. New York, NY, USA: Wiley, 2014.
63. W. Wang, X. Zhang, S. Gombault, and S. J. Knapskog, "Attribute normalization in network intrusion detection", in Proc. IEEE Int. Symp. Pervasive Syst., Algorithms, Netw. (ISPAN), Kaohsiung, Taiwan, Dec. 2009, pp. 448-453.
64. Q. Wei and R. L. Dunbrack, Jr., "The role of balanced training and testing data sets for binary classifiers in bioinformatics", PLoS ONE, vol. 8, no. 7, p. e67863, 2013.
65. O. Y. Al-Jarrah, O. Alhussein, P. D. Yoo, S. Muhaidat, K. Taha, and K. Kim, "Data randomization and cluster-based partitioning for botnet intrusion detection", IEEE Trans. Cybern., vol. 46, no. 8, pp. 1796-1806, Aug. 2015.
66. M. Sokolova, N. Japkowicz, and S. Szpakowicz, "Beyond accuracy, F-score and ROC: A family of discriminant measures for performance evaluation", in Proc. Austral. Joint Conf. Artif. Intell., Hobart, TAS, Australia, 2006, pp. 1015-1021.
67. P. D. Schloss and S. L. Westcott, "Assessing and improving methods used in operational taxonomic unit-based approaches for 16s rRNA gene sequence analysis", Appl. Environ. Microbiol., vol. 77, no. 10, pp. 3219-3226, 2011.
68. Z. Boger and H. Guterman, "Knowledge extraction from artificial neural network models", in Proc. IEEE Int. Conf. Syst., Man, Cybern., vol. 4. Orlando, FL, USA, Oct. 1997, pp. 3030-3035.
69. G. M. Weiss and F. Provost, "The effect of class distribution on classifier learning: An empirical study", Dept. Comput. Sci., Rutgers Univ., Piscataway, NJ, USA, Tech. Rep. ML-TR-44, 2001.
70. M. A. Hall and L. A. Smith, "Practical feature subset selection for machine learning", in Proc. Austral. Comput. Sci. Conf. (ACSC), Perth, WA, Australia, 1998, pp. 181-191.
71. R. Kohavi and G. H. John, "Wrappers for feature subset selection", Artif. Intell., vol. 97, nos. 1-2, pp. 273-324, 1997.