TY - GEN
T1 - Data-Driven Evaluation of Intrusion Detectors
T2 - 15th International Symposium on Foundations and Practice of Security, FPS 2022
AU - Ayoubi, Solayman
AU - Blanc, Gregory
AU - Jmila, Houda
AU - Silverston, Thomas
AU - Tixeuil, Sébastien
N1 - Publisher Copyright:
© 2023, The Author(s), under exclusive license to Springer Nature Switzerland AG.
PY - 2023/1/1
Y1 - 2023/1/1
N2 - Intrusion detection systems are an important domain in cybersecurity research. Countless solutions have been proposed, continuously improving upon one another. Yet, and despite the introduction of distinct approaches, including machine-learning methods, the evaluation methodology has barely evolved. In this paper, we design a comprehensive evaluation framework for Machine Learning (ML)-based intrusion detection systems (IDS) and take into account the unique aspects of ML algorithms, their strengths and weaknesses. The framework design is inspired by both i) traditional IDS evaluation methods and ii) recommendations for evaluating ML algorithms in diverse application areas. Data quality being the key to machine learning, we focus on data-driven evaluation by exploring data-related issues. Our approach goes beyond evaluating intrusion detection performance (also known as effectiveness) and aims at proposing standard data manipulation methods to tackle robustness and stability. Finally, we evaluate our framework through a qualitative comparison with other IDS evaluation approaches from the state of the art.
AB - Intrusion detection systems are an important domain in cybersecurity research. Countless solutions have been proposed, continuously improving upon one another. Yet, and despite the introduction of distinct approaches, including machine-learning methods, the evaluation methodology has barely evolved. In this paper, we design a comprehensive evaluation framework for Machine Learning (ML)-based intrusion detection systems (IDS) and take into account the unique aspects of ML algorithms, their strengths and weaknesses. The framework design is inspired by both i) traditional IDS evaluation methods and ii) recommendations for evaluating ML algorithms in diverse application areas. Data quality being the key to machine learning, we focus on data-driven evaluation by exploring data-related issues. Our approach goes beyond evaluating intrusion detection performance (also known as effectiveness) and aims at proposing standard data manipulation methods to tackle robustness and stability. Finally, we evaluate our framework through a qualitative comparison with other IDS evaluation approaches from the state of the art.
KW - Data-driven Evaluation
KW - Evaluation Framework
KW - Intrusion Detection System
KW - Machine learning
U2 - 10.1007/978-3-031-30122-3_9
DO - 10.1007/978-3-031-30122-3_9
M3 - Conference contribution
AN - SCOPUS:85152567140
SN - 9783031301216
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 142
EP - 157
BT - Foundations and Practice of Security - 15th International Symposium, FPS 2022, Revised Selected Papers
A2 - Jourdan, Guy-Vincent
A2 - Mounier, Laurent
A2 - Adams, Carlisle
A2 - Sèdes, Florence
A2 - Garcia-Alfaro, Joaquin
PB - Springer Science and Business Media Deutschland GmbH
Y2 - 12 December 2022 through 14 December 2022
ER -