LOW-EFFORT LABELING OF NETWORK EVENTS FOR INTRUSION DETECTION IN WLANS

Abstract

A typical data mining approach to network intrusion detection mandates a training dataset of network events labeled as either normal or a particular attack category. Such a training dataset is usually very large since there are many events to track. This is particularly the case in a WLAN where the number of devices communicating with the WLAN can be large and with adhoc connectivity. The large size of the unlabeled training dataset creates a problem for the domain expert who is asked to label the records toward creating a training dataset. We present an effective approach by which the number of network records the expert has to examine is a relatively small proportion of the given training dataset. A clustering algorithm is used to form relatively coherent groups which the expert examines as an entity to label records as one of four classes: Red (definite intrusion), Yellow (possibly intrusion), Blue (probably normal), and Green (definite normal). Subsequently, an ensemble classifier-based data cleansing approach is used to detect records that were likely mislabeled by the expert. The proposed approach is investigated with a case study of a large real-world WLAN. In addition, ensemble classifier-based intrusion detection models built using the labeled training dataset demonstrate the effectiveness of the labeling process with good generalization accuracy over multiple test datasets.