Unknown Attack Detection Based on Multistage One-Class SVM

The well-known datasets lack updating new types of attacks to enhance the detection of such sophisticated attacks. The research also presents the first application of a realistic dataset named Simple Network Management Protocol-Management Information Base in detecting unknown attacks. The SNMP-MIB dataset is updated with new attacks, mainly six types of Denial-of-Service attacks. And the model used in this research is a multistage One-Class Support Vector Machine SVM model for detecting unknown attacks. A new feature selection approach is presented. This approach uses two selection methods: wrapper and filter, and it is based on selecting the common features between the two methods through three stages. In the first stage, 15 features are selected, then in the second stage, 10 features are selected. Finally, the features that appear at each stage and in each method are selected to be used in the detection process. The One-Class SVM detection model has two stages. In the first stage, the classifier is trained using a dataset containing only normal sessions. Then it is tested using another two datasets; one contains known attacks, and the other contains unknown attacks. In the second stage, the second classifier is trained on the extracted sessions of the known attacks. Lastly, attacks not stored in the archive can be extracted as unknown attacks. The detection result of this model showed that it succeeded in detecting 97% of the unknown attacks with a false positive rate of 10%. The results verify this study’s contribution, demonstrating the effectiveness of one-class outlier detection approaches for detecting unknown attacks in network environments.