Volume 15, Number 1

A Lightweight Method for Detecting Cyber Attacks in High-traffic Large Networks based on Clustering Techniques

  Authors

Nguyen Hong Son¹ and Ha Thanh Dung², ¹Posts and Telecommunications Institute of Technology, Vietnam, ²Saigon University, Vietnam

  Abstract

Protecting information systems is a difficult and long-term task. The size and traffic intensity of computer networks are diverse and no one protection solution is universal for all cases. A certain solution protects well in the campus network, but it is unlikely to protect well in the service provider's network. A key component of a cyber defence system is a network attack detector. This component needs to be designed to have a good way to scale detection capabilities with network size and traffic intensity beyond the size and intensity of a campus network. From this point of view, this paper aims to build a network attack detection method suitable for the scale of large and high-traffic networks based on machine learning models using clustering techniques and our proposed detection technique. The detection technique is different from outlier detection commonly used in clustering-based anomaly detection applications. The method was evaluated in cases using different feature extraction methods and different clustering algorithms. Experimental results on the NSL-KDD data set are positive with a detection accuracy of over 97%.

  Keywords

Cyberattack Detection System, Clustering Techniques, High-Traffic Networks, Cluster Feature Vector.