International Journal of Scientific Research in Computer Science, Engineering and Information Technology

© 2019 IJSRCSEIT | Volume 5 | Issue 1 | ISSN : 2456-3307

Machine learning algorithm for Cyber Security - A Review
Mohammad Asif*, Pratap M. Mohite, Prof. P. D. Satya
Computer Science and Engineering, S.Y.C.E.T. Aurangabad, BATU, Lonere, Maharashtra, India

ABSTRACT

The computer networks are exposed to increasingly safety threats. With new kinds of attacks appearing usually,
growing flexible and adaptive protection-oriented strategies is a severe undertaking. In this context, anomaly-
primarily based community intrusion detection techniques are a precious era to guard target structures and
networks in opposition to malicious sports. Threats the internets are posing higher threat on IDS safety of
statistics. The primary concept is to utilize auditing programs to extract an in-depth set of capabilities that
describe each network connection or host session and practice statistics mining applications to learn rules that
correctly capture the behavior of intrusions and normal activities. Now Intrusion Detection has end up the
priority and on the crucial assignment of statistics protection administrators. A device deployed in a network is
at risk of numerous assaults and desires to be blanketed towards assaults. Intrusion detection machine is a
necessity of these days’ information safety area. It performs a vital function in detection of anomalous site
visitors in a community and indicators the network administrators to manage such visitors. The painting
supplied in this thesis is an attempt to locate such visitor’s anomalies in the networks through generating and
reading the site visitors float information.
Keywords : IDS (Intrusion Detection System), HIDS (Host Based Intrusion Detection System), ML (Machine
Learning), NIDS(Network Based Intrusion Detection System)

I. INTRODUCTION accelerated connectivity of laptop systems gives

greater get admission to outsiders and makes it less
This IDS supplied in this thesis implements the k- complicated for intruders to avoid detection. IDS are
means method of data mining for intrusion detection based on the perception that an intruder’s conduct
and the outlier detection technique the usage of can be exceptionally extraordinary from that of a
community outlier factor to locate the anomalies legitimate consumer. In view that many modern IDSs
present within the site visitors glide. The are built by using manual encoding of expert
performance of these two processes is compared expertise, modifications to IDSs are high priced and
through numerous confusion matrix and overall sluggish. in this paper, we describe a records mining
performance metrics like fake superb charge, framework for adaptively building Intrusion
sensitivity, specificity, type charge and precision, and Detection (ID) fashions. This record attempts a
an evaluation is accomplished to find out that which comprehensive compilation and categorization of
one of the tactics is higher for use for intrusion available intrusion detection gadget (IDS) products.
detection using site visitor’s waft. Intrusion detection lengthy studied and prototyped in academic and
is the hassle of identifying unauthorized use, misuse, authority’s circles, IDS have most effective within the
and abuse of computer systems by both machine last few years all started to emerge as a feasible and
insiders and outside penetrators. Namely, the useful commercial alternative. The primary industrial

CSEIT1951141 | Received : 20 Feb 2019 | Accepted : 28 Feb 2019 | January-February -2019 [ 5 (1) : 535-545 ]
535
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

IDS product becomes launched in 1991, with a ✓ It must impose a minimal overhead at the
relative handful emerging within the subsequent half system wherein it is walking; with a view to no
of dozen years. Then, inside the remaining couple of longer intervene with its ordinary operation.
years, the sphere underwent explosive increase. Even ✓ It needs to be capable of being configured in
after the obvious failure of numerous early releases, step with the security policies of the gadget this
there nevertheless remains at the least seventeen is being monitored.
extant products that claim to provide powerful ✓ It ought to be able to adapt to changes in device
intrusion detection in a networked environment. and person conduct over the years (e.g., new
Given this recent growth, and the reported improved applications being mounted, customers
utility of corporate assets to these products [1, 2, and converting from one hobby to another or new
3], the time has come for a complete assessment of assets being to be had those purpose
the subject. modifications in gadget aid utilization patterns).
✓ Anomalies are deviations from everyday
Intrusion detection structures try to discover laptop consumer behavior. Misuses, alternatively, are
misuse. Misuse is the overall performance of an recognized patterns of attack [5]. at the same
motion that isn't always favored by the machine time as misuse styles are frequently easier to
proprietor; one that doesn't comply with the device’s process and locate, it is frequently the paradox
ideal use and/or security coverage. IDSs mechanically patterns with a purpose to help to discover
examine online person hobby for forbidden (i.e., problems. As misuses are recognized styles of
invalid) and anomalous (i.e., strange, inconsistent) assault, the detection machine tends to fail
conduct. they're primarily based on the speculation whilst novel assault techniques are
that monitoring and reading community implemented. Detection of anomaly patterns is
transmissions, machine audit information, software computationally pricey due to the overhead of
audit data, device configuration, facts files, and keeping track of, and possibly updating several
different information can locate misuse. This record machine profile metrics, because it need to be
encompasses widespread portions of information, tailor-made gadget to device, and every now
effective analysis calls for detection1 specialized and and then even used to a person, due to the
constantly honed expertise, and at the least close to reality conduct styles and gadget usage vary
real-time of misuse is frequently important. significantly.
In [4], the subsequent characteristics are identified as ✓ Different IDSs had been designed to do
suited for IDS: dispensed collection and analysis of records. A
✓ It needs to run constantly with minimal human hierarchical device is defined in [6], and [7]
supervision. describes a cooperative gadget without a central
✓ It has to be fault tolerant in the sense that it has authority. these structures clear up maximum
to be capable of recover from gadget crashes, of the problems mentioned except for the
both unintended or because of malicious reconfiguration or adding skills to the IDS,
activity. Upon startup, the IDS have to be which aren't described in either of the 2
capable of recovering its previous country and designs.
resume its operation unaffected.
✓ The boom of the net has added excellent
✓ It ought to face up to subversion. The IDS need
benefits to society at the identical time the
to be able to screen itself and stumble on if it's
growing attacks on the IT Infrastructure are
been modified by way of an attacker.

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

536
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

getting an increasing number of serious issues The growth of Internet has brought great benefits to
and wishes to be addressed. Together with the the society at the same time the growing attacks on
growth of the internet, attacks also are growing the IT Infrastructure are becoming an increasingly
in parallel. serious issue and needs to be addressed. Along with
✓ Host-based intrusion detection system pursuits the growth of Internet attacks are also growing in
at detecting the intrusions at the host stage. parallel. In earlier days, the attacker should have a
They function in my opinion at each host of the good knowledge about the target infrastructure and
community. Consequently, they are able to knowledge on the Network, Operating Systems &
operate on distinctive type and quantity of Applications. Whereas today there are lots of open
records on the equal time. The host-based tools available in the Internet which can trigger
machine is dependent on the host operating automated attacks.
system. Any vulnerability inside the host-
primarily based OS can weaken the integrity of
the host-primarily based.

An outsider can exploit this vulnerability to release

an assault on the way to be hard to be detected
through the HIDS. as a result, a robust HIDS have
to be supported with the non-susceptible host OS.
The bodily deployment of HIDS in a community
may be visible the traffic enters from the internet
via the router or switch or firewall to the local
network. It is the responsibility of the HIDS in the
host to detect possible intrusions in the traffic flow.
Figure 2. Growth of Internet in terms of Host Count

WannaCry attack: In might also 2017, the

WannaCry Ransomware spread via the net, the use
of a make the most vector named EternalBlue. The
ransomware attack infected greater than 230,000
computer systems in over a hundred and fifty
countries the usage of 20 specific languages to
demand cash from users the usage of Bitcoin crypto
currency. WannaCry demanded US$300 in line
with pc. [9]

Petya attack: Petya computer virus spread in the

Figure 1 : Host based intrusion detection system course of April 2016, this malware infected the
grasp boot record of the laptop through encrypting
II. RELATED WORK the report tables of the NTFS file system. as soon as
infected on the next boot expects a ransom is paid.
again in the month of June 2017, a modified model

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

537
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

of Petya the usage of Eternal Blue exploit and this consideration as the collection deviation from
was aimed to create disruption alternatively to normal profile sequence. thus, this device works
generate income. [9] offline the use of previously accrued information
and implements the view desk set of rules for
We located that there are many benefits of gaining knowledge of software profiles significantly.
C4.5algorithms for special attacks occurs on your Duan et al. [12] have concentrated on identifying
dataset and C4.5 will detect the R2L and U2R compromised machines which can be recruited to
attacks and the neural network is the use of for hit upon junk mail zombies. An method SPOT is
detecting the DOS and Probe attacks and many proposed to experiment sequentially outgoing
greater. In this, we are the usage of four algorithms. messages by means of enforcing SPRT (Sequential
The primary one is okay-manner clustering and the possibility Ratio check). This method quick
second steps are fuzzy good judgment 1/3 steps are estimates whether a number is compromised or not.
SVM and the remaining and very last step is C4.5. figuring out compromised machines using malware
The blessings of all this set of rules are to detect the contamination device is said via Bot hunter [13].
assaults from the datasets. After that, it will
examine it with the SVM and C4.5 classifiers to This machine has massive no of steps that allow
find out how many attacks are coming about in the intrusion detection alarms correlation caused using
dataset at the same time as transferring the dataset inbound visitors with outgoing message trade
from supply to destination. [8] sample consequences. Bot Sniffer [14] explained in
his paintings approximately compromised device
This center also evolved a subsequent-era traits which might be a uniform temporal-spatial
mechanism which includes audit profiles of conduct for detecting zombies. This approach
person’s and may monitor the modern-day identifies zombies by using combining flows based
reputation of the consumer, if any change takes totally on server connections and searching flows
place with person’s hobby as compared with audit with comparable conduct respectively. Kumar and
profile of person then it will generate an alarm. Goyal [15] have explained implements genetic
algorithms in dataset training to categories the
Haystack [10] later developed a framework to labels that are smurf attacked and achieves a low
estimate an intrusion detection approach based false high-quality ratio of 0.2%. in addition,
totally on person and anomaly strategies. Six paintings were completed through Abdullah [16]
varieties of intrusion have been detected and and co-people elaborated intrusion detection class
people include the masquerade assaults, malicious regulations using genetic algorithms. Intrusion
use, leakage, carrier denial, the unauthorized detection policies the usage of genetic algorithms
consumer’s wreck-ins try, and get admission to becomes also the have a look at made through
control of a protection system. The source fire Ojugo et al. [17]. This approach uses health
developed suggests a community-based intrusion characteristic for estimating the rules. system
detection and prevention mechanism referred to as learning strategies are also applied to hit upon the
snicker machine that is an open supply. Forrest [11] intrusion. current device mastering strategies
in 1996 created an ordinary profile based on (artificial Neural Networks - ANN) for intrusion
studying the call sequences between intrusion detection was described by way of Roshani group
detection and protection in opposition to a human [18]. Gaikwad et al [19] added a technique based on
machine. An assault on this device is taken into fuzzy clustering and ANN approach.

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

538
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

which the statistics is destined can offer the

PROBLEM STATEMENT :- A few of the existing attacker the possibility of acting Insertion and
network- and host-based totally IDSs [20, 21] Evasion assaults. those assaults employ
perform records collection and analysis centrally mismatched assumptions inside the community
using a monolithic architecture. by using this, we protocol stacks of different hosts to hide the
mean that the facts is accrued through a single assaults or create a denial of- provider attacks.
host, both from audit trails or via tracking packets different IDSs had been designed to do
in a network, and analyzed by means of a dispensed collection and analysis of facts. A
unmarried module the usage of one of a kind hierarchical device is defined in [25], and [26]
techniques. other IDSs [22, 23] perform dispensed describes a cooperative gadget without a
facts collection (and some preprocessing) with the government. those systems resolve most of the
aid of the use of modules disbursed inside the hosts problems cited besides for the reconfiguration
which are being monitored, however the or including abilities to the IDS, which aren't
accumulated statistics remains shipped to a crucial described in either of the 2 designs.
vicinity in which it is analyzed through a ✓ Make a larger framework to resource
monolithic engine. an awesome overview of unsupervised ML: The feature choice" step
systems that take both methods is presented in within the framework currently requires
[24]. There are a number of issues with those labeled datasets to discover the most
architectures: discriminative talents. Destiny art work will
✓ The imperative analyzer is a single factor of dispose of this framework requirement to
failure. If an outsider can by some means save manual unsupervised ML with unlabeled
you it from operating (for instance, by crashing records. big effort in this thesis went into
or slowing down the host wherein it runs), the ensuring experiments have been representative
complete community is without safety. of actual-worldwide situations. This ensured
✓ Scalability is constrained. Processing all of the our outcomes have been considerable in
statistics at a unmarried host implies a limit on modern-day networks our datasets have been
the dimensions of the network that can be snapshots of community site visitors which
monitored. After that limit the vital analyzer may be analyzed opine in batch mode. For the
turns into not able to preserve up with the detectors to artwork on a live network.
town of statistics. Disbursed data collection can
also motive problems with excessive facts
visitors within the network.
✓ It’s far hard to reconfigure or add abilities to
the IDS. Changes and additions are generally
carried out by way of editing a configuration
report, including an entry to a desk or putting
in a brand new module. The IDS commonly
must be restarted to make the modifications
take impact.
✓ Analysis of network facts can be awed. As
shown in [20], appearing a set of network
information in a number other than the only to

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

539
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

supervised scheme implementing basis of K-means

and KDD CUP algorithms.

Logs documents need to be tested to understand any

compromised bills, originating IP’s, and all sources
accessed via using the attacker. All related sports want
to be collected and examined several weeks or even
months in advance than the detected event. capability
areas of future paintings are computerized correlation
and assessment of the log facts from cyber-attacks.
additional machine mastering algorithm.

PROPOSED SYSTEM: -According to base paper the

machine learning deal with two concept i.e.
supervised learning and unsupervised learning. Both
concept have some limitations, to overcome this
limitation we can concern with the concept of semi
supervised approach. In semi-supervised approach
concern two scenarios. In this approach front-end to
be implementing using of K-means Algorithm and
back-end to implementing using of KDDCUP 99. In
k-means algorithm concern to secure to be user
interface and KDD CUP 99 concern as to centralized
data storages on the system or host.
There are numerous procedures and methods utilized
in id. each method has deserved and demerits.
therefore, this paper highlights the similar
Figure 3 : Classification of ml algorithms for cyber distribution of attacks nature with the aid of using ok-
security applications [28] way and also the powerful accuracy of the Random
forest set of rules in detecting intrusions. This paper
Machine learning algorithms fragmented as describes complete sample popularity and machine
supervised learning and unsupervised learning. learning set of rules overall performance for the four
Behave of the scheme as to be defined as, supervised attack categories, which include Denial-of-service
learning which to be deal with more sophistication (DoS) attacks (deny legitimate request to a system),
rather than unsupervised learning but it has too costly Probing attacks (statistics gathering attacks),
and complexity. consumer-to-root (U2R) assaults (unauthorized access
to nearby splendid-consumer), and faraway-to-
But in case of unsupervised learning it takes a huge
neighborhood (R2L) attacks (unauthorized
amount of input but produce low amount of desirable
neighborhood get admission to from a faraway device)
output. The supervised scheme work under the expert
proven inside the KDD Cup 99 intrusion detection
system.
dataset.
To overcome the limitation of this, we can go with
semi supervised learning scheme. This semi

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

540
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

channeled effectively, vastly, it feasible to deal with

size of network facts and heterogeneity [29].

In this project, we use k-means algorithm to cluster

dataset connections. The k-means set of rules is one
of the widely recognized clustering tools.
K-means agencies the information according to
with their characteristic values right into a person-
particular variety of ok wonderful clusters. Facts
categorized into the same cluster have identical
characteristic values. k, the fantastic integer
denoting the number of clusters, desires to be
Figure 4 : - Overview of IDS furnished earlier. the steps involved in a k-means
algorithm are given consequently: [30]
III. METHODOLOGY
This project consists of the communication of the 1 1. K points denoting the data to be clustered are

algorithm of data mining class methods. Those is k- placed into the space. These points denote the
means primary group centroids.
2. The data are assigned to the group that is
K-means Clustering Algorithm: - adjacent to
the centroid.
Clustering, primarily based on distance 3. The positions of all the K centroids are
measurements carried out on items, and classifying recalculated
gadgets (invasions) into clusters. not like type, as soon as all the data are assigned.
classification because there may be no information 4. Repeat steps 2 and 3 until the centroid
about the label of studying statistics is an unattended unchanged.
getting to know system. For anomalous detection, we
will use welding and in-intensity evaluation to guide This consequence within the partition of facts into
the identity model. Dimension of distance or groups. The preprocessed dataset partition is
similarity performs a critical function in collecting achieved the usage of the ok-means set of rules
observations into homogeneous corporations. with k value as 5. due to the fact we have the
dataset that contains regular and 4 assault
Jacquard affinity size, the longest not unusual order categories which include DoS, Probe, U2R, R2L.
scale (LCS), is vital that the occasion is to evoke the
scale to decide if regular or odd. Euclidean distance is
about two vectors X and Y in space Euclidean n-
dimensions, the size of the distance widely used for
vector area. Euclidean distance can be defined
because the rectangular root of the whole difference
of the same vector dimension. Subsequently,
grouping and category algorithms want to be

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

541
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

KDDCup’99 dataset has variations of education

dataset; one is a complete education set having 5
million connections and the opposite is 10% of
this schooling set having 494021 connections.
since the whole dataset is huge, the test has been
completed on its smaller amount of dataset this is
10% of KDD. moreover, the KDDCup’99 dataset
consists of many assault behaviors, categorized
into 4 companies: Probe, Denial of provider (DoS),
user to Root (U2R), and far-flung to local (R2L)
[33]. these may be visible in desk I. normal
connections are created to profile than predicted
in a military network. The detailed information of
the two versions of schooling dataset may be seen
in table 1.

The KDDCUP 99 was simulated in a army

community environment and used for The 0.33
global understanding Discovery and information
Mining equipment opposition, which became held
alongside KDDCUP 99 The 5th international
convention on knowledge Discovery and facts
Mining. The competition challenge changed into
KDD Cup 99 Dataset: - The assessment of any to study a predictive model or a classifier able to
intrusion detection algorithm on actual network distinguishing among valid and illegitimate
data is extraordinarily tough particularly because connections in a computer community. This
of the high fee of acquiring proper labeling of dataset includes one form of normal records and
community connections. due to the actual pattern 24 distinctive sorts of assaults which might be
Table be gotten for intrusion detection, the categorized into four kinds such:
KDDCup’99 datasets are used as the sample to
confirm the overall performance of the misuse
detection model. The KDDCup’99 datasets,
referred by way of Columbia college, became
arranged from intrusions simulated in military
community surroundings on the DARPA in 1998.
It includes network connections obtained from a IV. CONCLUSION AND FUTURE SCOPE
sniffer that facts all network visitors the use of the In this project we can sophisticate more on K-
TCP unload layout. The overall simulated length is means rather than KDDCUP 99, because it
seven weeks. It was carried out in the MIT Lincoln valuable to aspect of semi supervisor concept. This
Labs after which announced at the UCI KDD Cup scheme facility to labeled and unlabeled dataset as
1999 Archive [32]. efficiency.

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

542
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

This paper provides a comparative evaluation [6] S. Staniford-Chen, S. Cheung, R. Crawford,M.

hybrid system getting to know approach to detect Dilger, J. Frank, J. Hoagland, K. Levitt,C. Wee,
the Denial of service (DoS) assaults, Probing R. Yip, and D. Zerkle. GrIDS: A graphbased
intrusion detection system for large
(Probe) assaults, consumer-to-Root (U2R) attacks,
networks.In Proceedings of the 19th National
and far off-to-neighborhood (R2L) attacks. we can
InformationSystems Security Conference,
understand the same nature of assault organization volume 1, pages 361-370. National Institute of
by the use of ok-manner algorithm. And then we Standardsand Technology, October 1996.
use to categories ordinary and attack connections. [7] Gregory B. White, Eric A. Fisch, and Udo
The experiments display that KDD Cup 99 dataset W.Pooch. Cooperating security managers: A
can be carried out as an effective benchmark peer basedintrusion detection system. IEEE
dataset to help researchers evaluate distinctive Network, pages 20-23, January/February 1996.
[8] Intrusion Detection System by using K-Means
intrusion detection fashions. future paintings Clustering, C 4.5, FNN, SVM Classifier Akshay
Takke1, Ravikumar Gujjul2, Mikhil Ghag3 ,
consist of analyzing with other records mining Vivek Pawar4, Vivek Pandey5 Page no:-636
algorithms to categories attack categories and how [9] International Journal of Advanced Research in
it could hit upon on different real-time Computer Science REVIEW PAPER Available
environment dataset. Online at www.ijarcs.info© 2015-19, IJARCS
All Rights Reserved 356 ISSN No. 0976-
We implement this project as more feasible as the
5697INTRUSION DETECTION SYSTEMS: A
basis of K-means algorithm.
REVIEW D. Ashok Kumar,S. R. Venugopalan
Page no:- [356-357]
V. REFERENCES
[10] Patcha, A. and Park, J. M. An overview of
anomaly detection techniques: Existing
[1] Adaptive Network Security: Solutions for solutions and latest technological
Managing Risk in an Interconnected World, trends.Computer Networks, 51(12);2007; 3448–
AberdeenGroup, Vol. 11, No. 5, January 1998. 3470.
[2] Hacker Stoppers? -- Companies Bought $65 [11] Forrest, S., Hofmeyr, S. A. , Somayaji, A. and
Million Worth Of Network-Intrusion Tools Longstaff, T. A. A Sense of Self for Unix
Last Year, But Capabilities Still Lag What's Processes, IEEE Symposium onResearch in
Promised, Information Week, April 1998 Security and Privacy, Oakland, CA, USA,
http://www.techweb.com/se/directlink.cgi?IW 1996;120--128.
K19980420S0066 [12] Duan, Z., Chen, P., Sanchez, F., Dong, Y.,
[3] Adaptive Network Security Management: Stephenson, M. and J. M. Barker, M. (2012).
Intrusion Detection and Security Assessment Detecting spam zombies bymonitoring
Come of Age, The Yankee Group Data outgoing messages, IEEE Trans. Dependable
Communications Report, Vol. 13, No, 10, June and Secure Computing, Apr 2012; 9(2):198–210
1998. [13] Gu, G., Porras, P., Yegneswaran V., Fong, M.
[4] Mark Crosbie and Gene Spafford. Active and Lee, W. BotHunter: detecting malware
defense of a computer system using infection through IDS-drivenialog correlation,
autonomous agents. Technical Report 95-008, Proc. of 16th USENIX Security Symp. (SS ’07),
COAST Group, Departmentof Computer Aug. 2007; 12:1–12:16.
Sciences, Purdue University,West Lafayette, IN [14] Gu, G., Zhang, J. and Lee, W. (2008).
47907-1398, Feb 1995. BotSniffer: detecting botnet command and
[5] Kumar S, Spafford EH (1994) An Application
ofPattern Matching in Intrusion Detection. control channels in network traffic, Proc.
TechnicalReport CSD-TR-94-013. Purdue Of15th Ann. Network and Distributed Sytem
University.
Security Symp. (NDSS ’08),

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

543
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

[15] Goyal, A. and Kumar, C. .GA-NIDS: A Genetic for detecting network intrusion and misuse.
Algorithm based Network Intrusion Detection Computers and Security, 12(3):235-248, May
System, Electrical Engineering and Computer 1993.
Science, North West University, Technical [23] S. R. Snapp, J. Brentano, G. V. Dias, T. L. Goan,
Report;2008.Feb. 2008. L. T. Heberlein, C. Ho, K. N. Levitt, B.
[16] Abdullah, B., Abd-algafar I., Salama G. I. and Mukherjee, S. E. Smaha, T. Grance, D. M. Teal,
Abd-alhafez A. Performance Evaluation of a and D. Mansur. DIDS (Distributed Intrusion
Genetic Algorithm BasedApproach to Network Detection System) - Motivation, Architecture,
Intrusion Detection System, Proceedings of and an early Prototype. In Proceedings of the
13th International Conference on Aerospace 14th National Computer Security Conference,
Sciences andAviation Technology (ASAT-13), pages 167-176, October 1991.
Military Technical College, Cairo, Egypt, [24] Biswanath Mukherjee, Todd L. Heberlein, and
2009;1-5. Karl N. Levitt. Network intrusion detection.
[17] Ojugo, A. A., Eboka, A. O., Okanta, O. E., Yora, IEEE Network, 8(3):26-41, May/June 1994.
R. E. and Aghware, F. O.Genetic Algorithm [25] Thomas H. Ptacek and Timothy N. Newsham.
Rule-Based IntrusionDetection System Insertion, evasion, and denial of service:
(GAIDS), Journal of Emerging Trends in Eluding network intrusion detection. Technical
Computing and Information Sciences, report, Secure Networks, Inc., January 1998.
3(8);2012; 1182 – 1194. [26] S. Staniford-Chen, S. Cheung, R. Crawford, M.
[18] Roshani Gaidhane, Vaidya, C. and Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee,
Raghuwanshi, M. Survey.Learning Techniques R. Yip, and D. Zerkle. GrIDS: A graph based
for Intrusion Detection System intrusion detection system for large networks.
(IDS),International Journal of Advance In Proceedings of the 19th National
Foundation and Research in Computer Information Systems Security Conference,
(IJAFRC) Feb 2014. ISSN 2348 – 4853, volume 1, pages 361-370. National Institute of
2014;1(2). Standards and Technology, October 1996.
[19] Gaikwad, Sonali Jagtap, D.P. Kunal Thakare [27] Gregory B. White, Eric A. Fisch, and Udo W.
and Vaishali Budhawant. Anomaly Based Pooch. Cooperating security managers: A peer
Intrusion Detection System UsingArtificial based intrusion detection system. IEEE
Neural Network and fuzzy clustering., Network, pages 20-23, January/February 1996.
International Journal of Engineering Research [28] Review Paper on Shallow Learning and Deep
& Technology (IJERT), ISSN:2278-0181, Learning Methods for Network security Afzal
November- 2012; 1(9). Ahmad1*, Mohammad Asif2, Shaikh Rohan Ali
[20] L. Heberlein, G. Dias, K. Levitt, B. Mukherjee, 3 (page: -52) 2018
J. Wood, and D. Wolber. A Network [29] Youssef Ahmed and Ahmed Emam, “Network
SecurityMonitor. In Proceedings of the IEEE Intrusion Detection Using Data Mining and
Symposium on Research in Security and Network Behavior Analysis”, International
Privacy, May 1990. Journal of Computer Science & Information
[21] R. Heady, G. Luger, A. Maccabe, and M. Technology (IJCSIT) Vol 3, No 6, Dec 2011.
Servilla. The Architecture of a Network Level [30] X. Wu, V.Kumar, Ross Quinlan, Joydeep
Intrusion Detection System. Technical report, Ghosh, Qiang Yang, Hiroshi Motoda, Geoffrey
University of New Mexico, Department of J. McLachlan, Angus Ng, Bing Liu, Philip S. Yu,
Computer Science, August 1990. Zhi-Hua Zhou, Michael Steinbach, David J.
[22] Judith Hochberg, Kathleen Jackson, Cathy Hand, and Dan Steinberg, “Top 10 algorithms
Stallings, J. F. McClary, David DuBois, and in data mining”, Survey Paper(2008).
Josephine Ford. NADIR: An automated system

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

544
 Mohammad Asif et al Int J Sci Res CSE & IT. January-February-2019 ; 5(1) : 535-545

[31] Intrusion Detection Based On Clustering Cite this article as :

Algorithm Nadya El MOUSSAID 1, Ahmed
TOUMANARI 2, Maryam ELAZHARI 3 Page- Mohammad Asif, Pratap M. Mohite, Prof. P. D. Satya,
1062 "Machine learning algorithm for Cyber Security - A
[32] P. S. Rath, M. Hohanty, S. Acharya and M. Review", International Journal of Scientific Research
Aich, “Optimization of IDS Algorithms Using
in Computer Science, Engineering and Information
Data Mining Technique”, Proceeding of 53rd
Technology (IJSRCSEIT), ISSN : 2456-3307, Volume
IRF International Conference, Pune,
India,ISBN 978-93-86083-01-2, 2016. 5 Issue 1, pp. 535-545, January-February 2019.
[33] L.S. Parihar and A. Tiwari, “Survey on Journal URL : http://ijsrcseit.com/CSEIT1951141
Intrusion Detection Usingn Data Mining
Methods”,IJSART, , Volume-2 Issue-1 ISSN
(online: 2395-1052) January-2016.

Authors Profile

Mohammad Asif received his B.E. degree

from NMU JALGAON INDIA.
Currently pursuing M.Tech.in Computer
Engineering from S.Y.C.E.T. Aurangabad
Affiliated to BATU Lonere.

Prof. Pratap Mohite B.Tech CSE

M.E.(Software Engineerng), Assistant
Professor Department of computer
Science and Engineering Shreeyash
College of Engineering and Technology,
Satara Parisar,Beed Bypass Road
Aurangabad.

Prof. Satya P.D. B.Tech. CSE, M.Tech.

and P.hD.(Pursuing), Assistant Professor
Department of computer Science and
Engineering Shreeyash College of
Engineering and Technology, Satara
Parisar,Beed Bypass Road Aurangabad.

Volume 5, Issue 1, January-February-2019 | http:// ijsrcseit.com

545