Cognitive unsupervised clustering for detecting cyber attacks
| dc.contributor.author | Nahiyan, Kaiser | |
| dc.contributor.examiningcommittee | McLeod, Bob (Electrical and Computer Engineering) Mohammed, Noman (Computer Science) | en_US |
| dc.contributor.supervisor | Ferens, Ken (Electrical and Computer Engineering) | en_US |
| dc.date.accessioned | 2020-07-02T16:40:45Z | |
| dc.date.available | 2020-07-02T16:40:45Z | |
| dc.date.copyright | 2020-06-27 | |
| dc.date.issued | 2020-06-26 | en_US |
| dc.date.submitted | 2020-06-27T18:23:42Z | en_US |
| dc.degree.discipline | Electrical and Computer Engineering | en_US |
| dc.degree.level | Master of Science (M.Sc.) | en_US |
| dc.description.abstract | It has always been a challenge to extract meaning out of unstructured data. In the field of network intrusion detection, the availability of structured, labelled datasets is limited. Most approaches adhere to techniques that demand high-end computing resources, and do not yield satisfactory results; hence human analysts must examine all the network events in order to isolate intrusion attempts. This study proposes an intelligent approach of extracting information out of large unstructured and unlabeled datasets and performs unsupervised detection of attack traffic from normal network traffic, utilizing the concepts of cognitive learning, complexity analysis, and statistical higher-order feature learning. The thesis aims to develop a methodology for the human analysts to disregard a major portion of the network dataset that contains regular traffic, and focus on the finite time-windows that have been subjected to potential attacks. Statistical higher-order feature extraction from network flows was used to create significant features out of the large unlabelled network intrusion detection dataset, which was later classified using unsupervised kmeans clustering and variance fractal dimension trajectory (VFDT) based complexity analysis. The proposed methodology has been validated using the UNSW-NB15 network intrusion dataset and the performance measures used are; detection accuracy, false positive and false negative rate, Receiver Operation Characteristics curve, Area Under Curve Value, and F1 score. Subsequently, a comparative analysis of the proposed model with a prominent traditional unsupervised machine learning technique (i.e. standard kmeans clustering) based scheme has been performed to evaluate and benchmark the efficacy of the proposed methodology. The empirically validated results show that the proposed cognitive unsupervised clustering technique-based model outperforms the general unsupervised detection scheme based on performance measures such as detection accuracy, false positive and false negative rates, Area Under Curve Value and F1 score. | en_US |
| dc.description.note | October 2020 | en_US |
| dc.identifier.uri | http://hdl.handle.net/1993/34747 | |
| dc.language.iso | eng | en_US |
| dc.rights | open access | en_US |
| dc.subject | Cognitive Intelligence | en_US |
| dc.subject | Machine Intelligence | en_US |
| dc.subject | Fractals | en_US |
| dc.subject | Classification | en_US |
| dc.subject | Cognitive Computing | en_US |
| dc.subject | Packet Captures | en_US |
| dc.subject | Complexity Analysis | en_US |
| dc.subject | Packet Captures | en_US |
| dc.subject | Network Threats | en_US |
| dc.subject | Cyber Security | en_US |
| dc.subject | Cognitive Informatics | en_US |
| dc.title | Cognitive unsupervised clustering for detecting cyber attacks | en_US |
| dc.type | master thesis | en_US |