Active learning approach to label network traffic datasets

Jorge L. Guerra Torres, Carlos A Catania, Eduardo Veas

Publikation: Beitrag in einer FachzeitschriftArtikelForschungBegutachtung

Abstract

In the field of network security, the process of labeling a network traffic dataset is specially expensive since expert knowledge is required to perform the annotations. With the aid of visual analytic applications such as RiskID, the effort of labeling network traffic is considerable reduced. However, since the label assignment still requires an expert pondering several factors, the annotation process remains a difficult task. The present article introduces a novel active learning strategy for building a random forest model based on user previously-labeled connections. The resulting model provides to the user an estimation of the probability of the remaining unlabeled connections helping him in the traffic annotation task. The article describes the active learning strategy, the interfaces with the RiskID system, the algorithms used to predict botnet behavior, and a proposed evaluation framework. The evaluation framework includes studies to assess not only the prediction performance of the active learning strategy but also the learning rate and resilience against noise as well as the improvements on other well known labeling strategies. The framework represents a complete methodology for evaluating the performance of any active learning solution. The evaluation results showed proposed approach is a significant improvement over previous labeling strategies.
Originalspracheenglisch
Aufsatznummer102388
Seitenumfang13
FachzeitschriftJournal of information security and applications
Jahrgang49
DOIs
PublikationsstatusVeröffentlicht - 2019

Fingerprint Untersuchen Sie die Forschungsthemen von „Active learning approach to label network traffic datasets“. Zusammen bilden sie einen einzigartigen Fingerprint.

  • Dieses zitieren