Title: Using machine learning methods for detecting network anomalies within SNMP-MIB dataset

Authors: Ghazi Al-Naymat; Mouhammd Al-Kasassbeh; Eshraq Al-Harwari

Addresses: Computer Science Department, Princess Sumaya University for Technology, Amman, Jordan ' Computer Science Department, Mutah University, Karak, Jordan ' Computer Science Department, Mutah University, Karak, Jordan

Abstract: One of the most prevalent network attacks that threaten networks is Denial of Service (DoS) flooding attacks. Hence, there is a need for effective approaches that can efficiently detect any intrusion in a network. This paper presents an efficient mechanism for network attacks detection within MIB data, which is associated with the protocol (SNMP). This paper investigates the impact of SNMP-MIB data in network anomalies detection. Classification approach is used to build the detection model. This approach presents a comprehensive study on the effectiveness of SNMP-MIB data in detecting different types of attack. The Random Forest classifier achieved the highest accuracy rate with the IP group (100%) and with the Interface group (99.93%). The results show that among five MIB groups the Interface and IP groups are the only groups that are affected the most by all types of attack, while the ICMP, TCP and UDP groups are less affected.

Keywords: anomaly detection; DoS attack; denial of service; SNMP; simple network management protocol; MIB; management information base; machine learning classifier.

DOI: 10.1504/IJWMC.2018.094644

International Journal of Wireless and Mobile Computing, 2018 Vol.15 No.1, pp.67 - 76

Received: 24 Jan 2018
Accepted: 25 Mar 2018
Published online: 10 Sep 2018 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article