Several decouplings of the electron propagator, including the relatively new P3+ approximation fo... more Several decouplings of the electron propagator, including the relatively new P3+ approximation for the selfenergy, have been used to calculate vertical electron detachment energies of tautomeric forms of closedshell, pentagonal, aromatic anions in which ring carbons without bonds to hydrogens appear. This study extends previous work in which the most stable forms of anionic, five-member rings with one to five nitrogens were considered. Whereas the lowest electron detachment energies sometimes are assigned by Koopmans's theorem results to π orbital vacancies, electron propagator calculations always obtain σ orbital vacancies for the ground states of the doublet radicals. Higher electron detachment energies that correspond to excited doublets with π vacancies also are presented. The predicted transition energies are in good agreement with low-intensity peaks in recent anion photoelectron spectra that have been assigned to less stable, tautomeric forms of these anions. * Corresponding authors. (J.V.O.) and [email protected] (M.K.M.).
Network traffic data is huge, varying and imbalanced because various classes are not equally dist... more Network traffic data is huge, varying and imbalanced because various classes are not equally distributed. Machine learning (ML) algorithms for traffic analysis uses the samples from this data to recommend the actions to be taken by the network administrators as well as training. Due to imbalances in dataset, it is difficult to train machine learning algorithms for traffic analysis and these may give biased or false results leading to serious degradation in performance of these algorithms. Various techniques can be applied during sampling to minimize the effect of imbalanced instances. In this paper various sampling techniques have been analysed in order to compare the decrease in variation in imbalances of network traffic datasets sampled for these algorithms. Various parameters like missing classes in samples, probability of sampling of the different instances have been considered for comparison.
Network traffic data is huge, varying and imbalanced because various classes are not equally dist... more Network traffic data is huge, varying and imbalanced because various classes are not equally distributed. Machine learning (ML) algorithms for traffic analysis uses the samples from this data to recommend the actions to be taken by the network administrators. Due to imbalances in dataset, machine learning algorithms may give biased or false results leading to serious degradation in performance of these algorithms. Since the network dataset is huge, during training machine learning algorithm takes more time and hence sampling should be used to reduce the training time. But using sampling may cause loss of information which should be taken care off while obtaining the samples. In this paper various sampling techniques have been analysed for loss of information and imbalances during sampling of network traffic data. Data set is collected from the Panjab University network. Various parameters like missing classes in samples, probability of sampling of the different instances have been considered for comparison.
Anomaly based Intrusion Detection Systems (IDS) learn normal and anomalous behavior by analyzing ... more Anomaly based Intrusion Detection Systems (IDS) learn normal and anomalous behavior by analyzing network traffic in various benchmark datasets. Common challenges for IDSs are large amounts of data to process, low detection rates and high rates of false alarms. In this paper, a technique based on the Online Sequential Extreme Learning Machine (OS-ELM) is presented for intrusion detection. The proposed technique uses alpha profiling to reduce the time complexity while irrelevant features are discarded using an ensemble of Filtered, Correlation and Consistency based feature selection techniques. Instead of sampling, beta profiling is used to reduce the size of the training dataset. For performance evaluation of proposed technique the standard NSL-KDD 2009 (Network Security Laboratory-Knowledge Discovery and Data Mining) dataset is used. In this paper time and space complexity of the proposed technique is also discussed. The experimental results yielded an accuracy of 98.66% with a false positive rate of 1.74% and a detection time of 2.43 seconds for binary class NSL-KDD dataset. The proposed IDS achieve 97.67% of accuracy with 1.74% of false positive rate in 2.65 seconds of detection time for multi-class NSL-KDD dataset. The Kyoto University benchmark dataset is also used to test the proposed IDS. Accuracy of 96.37% with false positive rate of 5.76% is yielded by proposed technique. The proposed technique outperforms other published techniques in terms of accuracy, false positive rate and detection time. Based on the experimental results achieved, we conclude that the proposed technique is an efficient method for network intrusion detection.
The network traffic dataset is a crucial part of anomaly based intrusion detection systems (IDSs)... more The network traffic dataset is a crucial part of anomaly based intrusion detection systems (IDSs). These IDSs train themselves to learn normal and anomalous activities. Properly labeled dataset is used for the training purpose. For the activities based IDSs, proper network traffic activity labeled dataset is the first requirement, however non-availability of such datasets is bottlenecked in the field of IDS research. In this experiment, a synthetic dataset "Panjab University - Intrusion Dataset (PU-IDS)" is created. The purpose of this study is to provide the researchers a reference dataset for the performance evaluation of network traffic activity based IDSs. University of New Brunswick Network Security Laboratory - Knowledge Disscovery in Databases (NSL-KDD) is a benchmark dataset for anomaly detection but it does not contain activity based labeling. So basic characteristics of this dataset are taken for the generation of the new synthetic dataset with various activities based labels. The dataset is first categorized as per protocol and service. Thereafter, as per minimum & maximum values of attributes, activity profiles are synthetically generated. This paper also discusses various statistical characteristics of PU-IDS. The total number of 198533 instances along with 273 of activity profiles are created. This dataset also contain different 98 protocol_service profiles.
Time taken by Intrusion Detection System (IDS) in order to detect malwares is very crucial factor... more Time taken by Intrusion Detection System (IDS) in order to detect malwares is very crucial factor. Network traffic dataset have many features and all may not contribute in detection of threats. Rejecting irrelevant features may increase performance of IDS by reducing computational time. In this paper, feature selection techniques based on Gain ratio attribute, Correlation feature selection, Chi Squared attribute, Consistency subset, Filtered attribute, Filtered subset, Information gain attribute, One RA attribute and Symmetrical Uncert attribute evaluation are tested on three classifiers (Naïve Bayes, J48 and PART) by using Weka data mining and machine learning tool on UCI KDD CUP 1999 network traffic dataset. The feature selection methods are analyzed on parameters like accuracy, number of features selected out of total features, time taken, TP rate and FP rate. The result shows that almost same level of accuracy can be achieved by reducing number of features considerably which also takes less computational time to detect threats. Filtered subset evaluation comes out to be best technique which suggests only 17.07 % of total features. Hence it is proposed that reduced number of features should be used in IDS for the quick detection of threats.
Intrusion detection systems (IDS) have to process millions of packets with many features, which d... more Intrusion detection systems (IDS) have to process millions of packets with many features, which delay the detection of anomalies. Sampling and feature selection may be used to reduce computation time and hence minimizing intrusion detection time. This paper aims to suggest some feature selection algorithm on the basis of The Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS). TOPSIS is used to suggest one or more choice(s) among some alternatives, having many attributes. Total ten feature selection techniques have been used for the analysis of KDD network dataset. Three classifiers namely Naïve Bayes, J48 and PART have been considered for this experiment using Weka data mining tool. Ranking of the techniques using TOPSIS have been calculated by using MATLAB as a tool. Out of these techniques Filtered Subset Evaluation has been found suitable for intrusion detection in terms of very less computational time with acceptable accuracy.
In sampling of huge network traffic dataset, some packets are chosen out of total packets. Leftov... more In sampling of huge network traffic dataset, some packets are chosen out of total packets. Leftover packets may have effect on statistical characteristics of the data. In this paper effect of sampling on statistical characteristics is discussed. A well-known benchmarked NSL KDD network traffic dataset is used. Three sampling techniques namely - random, systematic and under-over sampling are used. Various attributes of dataset considered are duration, src_bytes, dst_bytes, wrong_fragment, num_compromised, num_file_ creations and srv_count. Parameter of statistical characteristics like range, mean and standard deviation is used for analysis purpose. Result shows that sampling has considerable statistical effect on network traffic dataset.
Network traffic data is huge, varying and imbalanced because various classes are not equally dist... more Network traffic data is huge, varying and imbalanced because various classes are not equally distributed. Machine learning (ML) algorithms for traffic analysis uses the samples from this data to recommend the actions to be taken by the network administrators as well as training. Due to imbalances in dataset, it is difficult to train machine learning algorithms for traffic analysis and these may give biased or false results leading to serious degradation in performance of these algorithms. Various techniques can be applied during sampling to minimize the effect of imbalanced instances. In this paper various sampling techniques have been analysed in order to compare the decrease in variation in imbalances of network traffic datasets sampled for these algorithms. Various parameters like missing classes in samples, probability of sampling of the different instances have been considered for comparison.
Monitoring of network traffic flow is very important for network management. Classifying network ... more Monitoring of network traffic flow is very important for network management. Classifying network traffic can detect hidden patterns of possible threat. Classification is a tool of network administrator to find out hidden threats to network. In this paper we have analysed network traffic which is captured on Panjab University campus network. This traffic is classified and certain alarming results are found despite the use of all security measures by network administrators. For performing this experiment open source tools like tcpdump, wirehark, linux etc.
Bandwidth is very crucial and limited resource available, so it should be properly utilized. Netw... more Bandwidth is very crucial and limited resource available, so it should be properly utilized. Network congestion occurs when a link or node is carrying large amount of data in case of flood attack and quality of service deteriorates. Effects of flood attack include queuing delay, packet loss or the blocking of new connections. As a consequence incremental increases in offered load leads to either small increase in network throughput, or to an actual reduction in network throughput. Modern networks use congestion control and avoidance techniques to avoid such congestion collapses. One of widely used queuing algorithm is Drop Tail which is used in most of the routers to avoid congestion and to encourage smooth flow of packets. In this paper we propose a technique to better utilize bandwidth under flood attack. Simulations of the proposed technique have been carried out to compare it with the DropTail. Ns-2 is used as the simulation tool. In this simulation experiment, different types of traffic like tcp, udp are considered. Routers are attacked with different attack intensities to determine the effect of proposed method under various circumstances.
Several decouplings of the electron propagator, including the relatively new P3+ approximation fo... more Several decouplings of the electron propagator, including the relatively new P3+ approximation for the selfenergy, have been used to calculate vertical electron detachment energies of tautomeric forms of closedshell, pentagonal, aromatic anions in which ring carbons without bonds to hydrogens appear. This study extends previous work in which the most stable forms of anionic, five-member rings with one to five nitrogens were considered. Whereas the lowest electron detachment energies sometimes are assigned by Koopmans's theorem results to π orbital vacancies, electron propagator calculations always obtain σ orbital vacancies for the ground states of the doublet radicals. Higher electron detachment energies that correspond to excited doublets with π vacancies also are presented. The predicted transition energies are in good agreement with low-intensity peaks in recent anion photoelectron spectra that have been assigned to less stable, tautomeric forms of these anions. * Corresponding authors. (J.V.O.) and [email protected] (M.K.M.).
Network traffic data is huge, varying and imbalanced because various classes are not equally dist... more Network traffic data is huge, varying and imbalanced because various classes are not equally distributed. Machine learning (ML) algorithms for traffic analysis uses the samples from this data to recommend the actions to be taken by the network administrators as well as training. Due to imbalances in dataset, it is difficult to train machine learning algorithms for traffic analysis and these may give biased or false results leading to serious degradation in performance of these algorithms. Various techniques can be applied during sampling to minimize the effect of imbalanced instances. In this paper various sampling techniques have been analysed in order to compare the decrease in variation in imbalances of network traffic datasets sampled for these algorithms. Various parameters like missing classes in samples, probability of sampling of the different instances have been considered for comparison.
Network traffic data is huge, varying and imbalanced because various classes are not equally dist... more Network traffic data is huge, varying and imbalanced because various classes are not equally distributed. Machine learning (ML) algorithms for traffic analysis uses the samples from this data to recommend the actions to be taken by the network administrators. Due to imbalances in dataset, machine learning algorithms may give biased or false results leading to serious degradation in performance of these algorithms. Since the network dataset is huge, during training machine learning algorithm takes more time and hence sampling should be used to reduce the training time. But using sampling may cause loss of information which should be taken care off while obtaining the samples. In this paper various sampling techniques have been analysed for loss of information and imbalances during sampling of network traffic data. Data set is collected from the Panjab University network. Various parameters like missing classes in samples, probability of sampling of the different instances have been considered for comparison.
Anomaly based Intrusion Detection Systems (IDS) learn normal and anomalous behavior by analyzing ... more Anomaly based Intrusion Detection Systems (IDS) learn normal and anomalous behavior by analyzing network traffic in various benchmark datasets. Common challenges for IDSs are large amounts of data to process, low detection rates and high rates of false alarms. In this paper, a technique based on the Online Sequential Extreme Learning Machine (OS-ELM) is presented for intrusion detection. The proposed technique uses alpha profiling to reduce the time complexity while irrelevant features are discarded using an ensemble of Filtered, Correlation and Consistency based feature selection techniques. Instead of sampling, beta profiling is used to reduce the size of the training dataset. For performance evaluation of proposed technique the standard NSL-KDD 2009 (Network Security Laboratory-Knowledge Discovery and Data Mining) dataset is used. In this paper time and space complexity of the proposed technique is also discussed. The experimental results yielded an accuracy of 98.66% with a false positive rate of 1.74% and a detection time of 2.43 seconds for binary class NSL-KDD dataset. The proposed IDS achieve 97.67% of accuracy with 1.74% of false positive rate in 2.65 seconds of detection time for multi-class NSL-KDD dataset. The Kyoto University benchmark dataset is also used to test the proposed IDS. Accuracy of 96.37% with false positive rate of 5.76% is yielded by proposed technique. The proposed technique outperforms other published techniques in terms of accuracy, false positive rate and detection time. Based on the experimental results achieved, we conclude that the proposed technique is an efficient method for network intrusion detection.
The network traffic dataset is a crucial part of anomaly based intrusion detection systems (IDSs)... more The network traffic dataset is a crucial part of anomaly based intrusion detection systems (IDSs). These IDSs train themselves to learn normal and anomalous activities. Properly labeled dataset is used for the training purpose. For the activities based IDSs, proper network traffic activity labeled dataset is the first requirement, however non-availability of such datasets is bottlenecked in the field of IDS research. In this experiment, a synthetic dataset "Panjab University - Intrusion Dataset (PU-IDS)" is created. The purpose of this study is to provide the researchers a reference dataset for the performance evaluation of network traffic activity based IDSs. University of New Brunswick Network Security Laboratory - Knowledge Disscovery in Databases (NSL-KDD) is a benchmark dataset for anomaly detection but it does not contain activity based labeling. So basic characteristics of this dataset are taken for the generation of the new synthetic dataset with various activities based labels. The dataset is first categorized as per protocol and service. Thereafter, as per minimum & maximum values of attributes, activity profiles are synthetically generated. This paper also discusses various statistical characteristics of PU-IDS. The total number of 198533 instances along with 273 of activity profiles are created. This dataset also contain different 98 protocol_service profiles.
Time taken by Intrusion Detection System (IDS) in order to detect malwares is very crucial factor... more Time taken by Intrusion Detection System (IDS) in order to detect malwares is very crucial factor. Network traffic dataset have many features and all may not contribute in detection of threats. Rejecting irrelevant features may increase performance of IDS by reducing computational time. In this paper, feature selection techniques based on Gain ratio attribute, Correlation feature selection, Chi Squared attribute, Consistency subset, Filtered attribute, Filtered subset, Information gain attribute, One RA attribute and Symmetrical Uncert attribute evaluation are tested on three classifiers (Naïve Bayes, J48 and PART) by using Weka data mining and machine learning tool on UCI KDD CUP 1999 network traffic dataset. The feature selection methods are analyzed on parameters like accuracy, number of features selected out of total features, time taken, TP rate and FP rate. The result shows that almost same level of accuracy can be achieved by reducing number of features considerably which also takes less computational time to detect threats. Filtered subset evaluation comes out to be best technique which suggests only 17.07 % of total features. Hence it is proposed that reduced number of features should be used in IDS for the quick detection of threats.
Intrusion detection systems (IDS) have to process millions of packets with many features, which d... more Intrusion detection systems (IDS) have to process millions of packets with many features, which delay the detection of anomalies. Sampling and feature selection may be used to reduce computation time and hence minimizing intrusion detection time. This paper aims to suggest some feature selection algorithm on the basis of The Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS). TOPSIS is used to suggest one or more choice(s) among some alternatives, having many attributes. Total ten feature selection techniques have been used for the analysis of KDD network dataset. Three classifiers namely Naïve Bayes, J48 and PART have been considered for this experiment using Weka data mining tool. Ranking of the techniques using TOPSIS have been calculated by using MATLAB as a tool. Out of these techniques Filtered Subset Evaluation has been found suitable for intrusion detection in terms of very less computational time with acceptable accuracy.
In sampling of huge network traffic dataset, some packets are chosen out of total packets. Leftov... more In sampling of huge network traffic dataset, some packets are chosen out of total packets. Leftover packets may have effect on statistical characteristics of the data. In this paper effect of sampling on statistical characteristics is discussed. A well-known benchmarked NSL KDD network traffic dataset is used. Three sampling techniques namely - random, systematic and under-over sampling are used. Various attributes of dataset considered are duration, src_bytes, dst_bytes, wrong_fragment, num_compromised, num_file_ creations and srv_count. Parameter of statistical characteristics like range, mean and standard deviation is used for analysis purpose. Result shows that sampling has considerable statistical effect on network traffic dataset.
Network traffic data is huge, varying and imbalanced because various classes are not equally dist... more Network traffic data is huge, varying and imbalanced because various classes are not equally distributed. Machine learning (ML) algorithms for traffic analysis uses the samples from this data to recommend the actions to be taken by the network administrators as well as training. Due to imbalances in dataset, it is difficult to train machine learning algorithms for traffic analysis and these may give biased or false results leading to serious degradation in performance of these algorithms. Various techniques can be applied during sampling to minimize the effect of imbalanced instances. In this paper various sampling techniques have been analysed in order to compare the decrease in variation in imbalances of network traffic datasets sampled for these algorithms. Various parameters like missing classes in samples, probability of sampling of the different instances have been considered for comparison.
Monitoring of network traffic flow is very important for network management. Classifying network ... more Monitoring of network traffic flow is very important for network management. Classifying network traffic can detect hidden patterns of possible threat. Classification is a tool of network administrator to find out hidden threats to network. In this paper we have analysed network traffic which is captured on Panjab University campus network. This traffic is classified and certain alarming results are found despite the use of all security measures by network administrators. For performing this experiment open source tools like tcpdump, wirehark, linux etc.
Bandwidth is very crucial and limited resource available, so it should be properly utilized. Netw... more Bandwidth is very crucial and limited resource available, so it should be properly utilized. Network congestion occurs when a link or node is carrying large amount of data in case of flood attack and quality of service deteriorates. Effects of flood attack include queuing delay, packet loss or the blocking of new connections. As a consequence incremental increases in offered load leads to either small increase in network throughput, or to an actual reduction in network throughput. Modern networks use congestion control and avoidance techniques to avoid such congestion collapses. One of widely used queuing algorithm is Drop Tail which is used in most of the routers to avoid congestion and to encourage smooth flow of packets. In this paper we propose a technique to better utilize bandwidth under flood attack. Simulations of the proposed technique have been carried out to compare it with the DropTail. Ns-2 is used as the simulation tool. In this simulation experiment, different types of traffic like tcp, udp are considered. Routers are attacked with different attack intensities to determine the effect of proposed method under various circumstances.
Uploads
Papers by Raman Singh