arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2104.09029cs.NIcs.CRcs.LG
收藏

基准测试的基准——合成NIDS数据集分析

Benchmarking the Benchmark -- Analysis of Synthetic NIDS Datasets

The University of Queensland(昆士兰大学)

Siamak Layeghy, Marcus Gallagher, Marius Portmann

AI总结:

本文分析了三个合成NIDS数据集与两个真实网络数据集的统计特性,发现合成数据集与真实数据集存在显著差异,质疑了基于合成数据集训练的ML分类器在真实网络中的泛化能力。

摘要:

网络入侵检测系统(NIDSs)是预防和缓解网络攻击日益重要的工具。研究人员已经生成并公开发布了多个带标签的合成数据集,它们已成为评估新的基于ML的NIDS分类器的基准。最近发表的结果显示,使用这些数据集获得了极佳的分类性能,在准确率、F1分数等关键评估指标上越来越接近100%。遗憾的是,我们尚未看到这些优秀的学术研究成果转化为具有如此近乎完美性能的实用NIDS系统。这促使我们进行本文的研究,在此我们分析了三个较新且相关的NIDS数据集(CIC、UNSW等)中良性流量的统计特性。作为对比,我们考虑了从真实生产网络获取的两个数据集,一个来自大学网络,另一个来自中型互联网服务提供商(ISP)。我们的结果表明,在所考虑的大多数统计特征方面,两个真实世界数据集彼此之间非常相似。同样,三个合成数据集在其组内也相对相似。然而,最重要的是,我们的结果显示这三个合成数据集与两个真实世界数据集之间在所考虑的大多数统计特征上存在明显差异。由于ML依赖于训练和测试数据集从同一分布采样的基本假设,这引发了在所考虑的合成数据集上训练的ML分类器的性能结果能在多大程度上转化并泛化到真实世界网络的问题。我们认为这是一个有趣且相关的问题,为该领域的进一步研究提供了动力。

英文摘要:

Network Intrusion Detection Systems (NIDSs) are an increasingly important tool for the prevention and mitigation of cyber attacks. A number of labelled synthetic datasets generated have been generated and made publicly available by researchers, and they have become the benchmarks via which new ML-based NIDS classifiers are being evaluated. Recently published results show excellent classification performance with these datasets, increasingly approaching 100 percent performance across key evaluation metrics such as accuracy, F1 score, etc. Unfortunately, we have not yet seen these excellent academic research results translated into practical NIDS systems with such near-perfect performance. This motivated our research presented in this paper, where we analyse the statistical properties of the benign traffic in three of the more recent and relevant NIDS datasets, (CIC, UNSW, ...). As a comparison, we consider two datasets obtained from real-world production networks, one from a university network and one from a medium size Internet Service Provider (ISP). Our results show that the two real-world datasets are quite similar among themselves in regards to most of the considered statistical features. Equally, the three synthetic datasets are also relatively similar within their group. However, and most importantly, our results show a distinct difference of most of the considered statistical features between the three synthetic datasets and the two real-world datasets. Since ML relies on the basic assumption of training and test datasets being sampled from the same distribution, this raises the question of how well the performance results of ML-classifiers trained on the considered synthetic datasets can translate and generalise to real-world networks. We believe this is an interesting and relevant question which provides motivation for further research in this space.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑