Machine learning approach for detection of nonTor traffic

Hodo, Elike and Bellekens, Xavier and Iorkyase, Ephraim and Hamilton, Andrew and Tachtatzis, Christos and Atkinson, Robert; (2017) Machine learning approach for detection of nonTor traffic. In: ARES '17 Proceedings of the 12th International Conference on Availability, Reliability and Security. ACM, New York. ISBN 9781450352574 (https://doi.org/10.1145/3098954.3106068)

[thumbnail of Hodo-etal-ARES-2017-Machine-learning-approach-for-detection-of-nonTor-traffic]
Preview
 Text. Filename: Hodo_etal_ARES_2017_Machine_learning_approach_for_detection_of_nonTor_traffic.pdf
Accepted Author Manuscript
Download (447kB)| Preview

Abstract

Intrusion detection has attracted a considerable interest from researchers and industries. After many years of research the community still faces the problem of building reliable and efficient intrusion detection systems (IDS) capable of handling large quantities of data with changing patterns in real time situations. The Tor network is popular in providing privacy and security to end user by anonymising the identity of internet users connecting through a series of tunnels and nodes. This work focuses on the classification of Tor traffic and nonTor traffic to expose the activities within Tor traffic that minimizes the protection of users. A study to compare the reliability and efficiency of Artificial Neural Network and Support vector machine in detecting nonTor traffic in UNB-CIC Tor Network Traffic dataset is presented in this paper. The results are analysed based on the overall accuracy, detection rate and false positive rate of the two algorithms. Experimental results show that both algorithms could detect nonTor traffic in the dataset. A hybrid Artificial neural network proved a better classifier than SVM in detecting nonTor traffic in UNB-CIC Tor Network Traffic dataset.

ORCID iDs

Hodo, Elike ORCID logoORCID: https://orcid.org/0000-0002-8686-3418, Bellekens, Xavier, Iorkyase, Ephraim ORCID logoORCID: https://orcid.org/0000-0002-1995-4387, Hamilton, Andrew ORCID logoORCID: https://orcid.org/0000-0002-8436-8325, Tachtatzis, Christos ORCID logoORCID: https://orcid.org/0000-0001-9150-6805 and Atkinson, Robert ORCID logoORCID: https://orcid.org/0000-0002-6206-2229;
CORE (COnnecting REpositories)