Evaluating Techniques for Practical Cloud-based Network Intrusion Detection
Peter Cocoros, Matthew Sobocinski, Kyle G. Steiger, Joel Coffman · 2020
Machine learning and anomaly detection techniques are commonly used to perform network intrusion detection. Though a great deal of research exists in this domain, many publications focus on a single technique applied to a single dataset instead of demonstrating baseline results for a suite of techniques applied to multiple datasets. Variations in experimental procedures complicate comparison across research efforts. Furthermore, the limited scope of many research efforts often does not translate to usefulness in real-world environments. As services continue to be migrated to cloud-based infrastructures, attack surfaces increase in size, providing more opportunity for attackers and increasing the need for network-based protections. We present a set of experiments and insights demonstrating how commonly applied anomaly detection and machine learning techniques perform against three of the most frequently used and highly regarded intrusion detection datasets. In many cases, our results are comparable to those reported in prior work, but our results indicate how techniques generalize to other datasets.