Özet:

Network flow data is large-scale data and makes it difficult to detect anomalies by processing all data with machine learning algorithms. However, not all properties are required to classify the network flow data. Unnecessary properties increase the transaction burden, while also decrease the detection rates. It is useful to identify the best properties that can represent the data set. In the framework of this information, this study aims to investigate the effects of filtering-based identity selection (OS) methods on Internet networks on anomaly-based attack detection systems (STS). The NSLKDD data set was used in the study. KDDTrain20Percent data set in the NSLKDD data set is used for training, KDDTest data set is used for testing. Thus, the system trained with a different data set has been tested with a different test set to prove the reliability of the system. The data collection contains 41 subjects. The study first reduced data size with filtering-based Information Profit, Profit Rate, Simetric Uncertainty Assessment, Ki-Care, One-R and Correlation-based Properties Selection methods. The first 8 properties are selected according to the ranking procedure in each proprietary selection method and are drawn to the classifiers as the last data set. The properties vectors are classified by the methods k-The Nearest Neighnorhood (KNN) and Rastgele Forest (RO). As performance standards, the processing time, accuracy, positive correct ratio, positive error ratio and field values under the ROC (Receiver Operator Characteristic) curve are used. From the classification point of view, the RO method has been shown to be more successful than the KNN method, the results obtained by raw data set, and if necessary, the data set reduced to 8 subjectivity. When all the results were evaluated, information gain, Ki-Kare, One-R methods were observed as the best way to classify selected properties by RO method, and the conclusion was that AS methods contributed to STS in a positive direction.

Anahtar Kelimeler: