Machine learning classification model for Network based Intrusion Detection System

摘要

With an enormous increase in number of mobile users, mobile threats are also growing rapidly. Mobile malwares can lead to several cybersecurity threats i.e. stealing sensitive information, installing backdoors, ransomware attacks and sending premium SMSs etc. Previous studies have shown that due to the sophistication of threats and tailored techniques to avoid detection, not every antivirus system is capable of detecting advance threats. However, an extra layer of security at the network side can protect users from these advanced threats by analyzing the traffic patterns. To detect these threats, this paper proposes and evaluates, a Machine Learning (ML) based model for Network based Intrusion Detection Systems (NIDS). In this research, several supervised ML classifiers were built using data-sets containing labeled instances of network traffic features generated by several malicious and benign applications. The focus of this research is on Android based malwares due to its global share in mobile malware and popularity among users. Based on the evaluation results, the model was able to detect known and unknown threats with the accuracy of up to 99.4%. This ML model can also be integrated with traditional intrusion detection systems in order to detect advanced threats and reduce false positives.