期刊名称：TELKOMNIKA (Telecommunication Computing Electronics and Control)
印刷版ISSN：2302-9293
出版年度：2021
卷号：19
期号：4
DOI：10.12928/telkomnika.v19i4.20402
语种：English
出版社：Universitas Ahmad Dahlan
摘要：The rapid network technology growth causing various network problems, attacks are becoming more sophisticated than defenses. In this paper, we proposed traffic classification by using machine learning technique, and statistical flow features such as five tuples for the training dataset. A rule-based system, Snort is used to identify the severe harmfulness data packets and reduce the training set dimensionality to a manageable size. Comparison of performance between training dataset that consists of all priorities malicious flows with only has priority 1 malicious flows are done. Different machine learning (ML) algorithms performance in terms of accuracy and efficiency are analyzed. Results show that Naïve Bayes achieved accuracy up to 99.82% for all priorities while 99.92% for extracted priority 1 of malicious flows training dataset in 0.06 seconds and be chosen to classify traffic in real-time process. It is demonstrated that by taking just five tuples information as features and using Snort alert information to extract only important flows and reduce size of dataset is actually comprehensive enough to supply a classifier with high efficiency and accuracy which can sustain the safety of network.
关键词：machine learning;malicious traffic flows;online classification;snort alerts;statistical features
