A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems

Abstract

As the world moves towards being increasingly dependent on computers and automation, building secure applications, systems and networks are some of the main challenges faced in the current decade. The number of threats that individuals and businesses face is rising exponentially due to the increasing complexity of networks and services of modern networks. To alleviate the impact of these threats, researchers have proposed numerous solutions for anomaly detection; however, current tools often fail to adapt to ever-changing architectures, associated threats and zero-day attacks. This manuscript aims to pinpoint research gaps and shortcomings of current datasets, their impact on building Network Intrusion Detection Systems (NIDS) and the growing number of sophisticated threats. To this end, this manuscript provides researchers with two key pieces of information; a survey of prominent datasets, analyzing their use and impact on the development of the past decade's Intrusion Detection Systems (IDS) and a taxonomy of network threats and associated tools to carry out these attacks. The manuscript highlights that current IDS research covers only 33.3% of our threat taxonomy. Current datasets demonstrate a clear lack of real-network threats, attack representation and include a large number of deprecated threats, which together limit the detection accuracy of current machine learning IDS approaches. The unique combination of the taxonomy and the analysis of the datasets provided in this manuscript aims to improve the creation of datasets and the collection of real-world data. As a result, this will improve the efficiency of the next generation IDS and reflect network threats more accurately within new datasets.

arXiv comment28 Pages, 6 Figures

References in corpus (12)

• A Survey of Network-based Intrusion Detection Data Sets
• IoT Sentinel: Automated Device-Type Identification for Security Enforcement in IoT
• Deep Learning for Encrypted Traffic Classification: An Overview
• Threat analysis of IoT networks Using Artificial Neural Network Intrusion Detection System
• Shallow and Deep Networks Intrusion Detection System: A Taxonomy and Survey
• Adaptive Artificial Immune Networks for Mitigating DoS flooding Attacks
• A New Clustering Approach for Anomaly Intrusion Detection
• Machine Learning in Cyber-Security - Problems, Challenges and Data Sets
• Improving SIEM for Critical SCADA Water Infrastructures Using Machine Learning
• Novel Intrusion Detection using Probabilistic Neural Network and Adaptive Boosting
• GLoP: Enabling Massively Parallel Incident Response Through GPU Log Processing
• On generating network traffic datasets with synthetic attacks for intrusion detection

Cited by in corpus (10)

• Cyber Security in the Age of COVID-19: A Timeline and Analysis of Cyber-Crime and Cyber-Attacks during the Pandemic
• Utilising Deep Learning Techniques for Effective Zero-Day Attack Detection
• Leveraging Siamese Networks for One-Shot Intrusion Detection Model
• Network Intrusion Datasets: A Survey, Limitations, and Recommendations
• Gotham Testbed: a Reproducible IoT Testbed for Security Experiments and Dataset Generation
• Combinatorial Optimization based Feature Selection Method: A study on Network Intrusion Detection
• Utilising Flow Aggregation to Classify Benign Imitating Attacks
• Bridging the gap to real-world for network intrusion detection systems with data-centric approach
• Machine Learning Based IoT Intrusion Detection System: An MQTT Case Study (MQTT-IoT-IDS2020 Dataset)
• From Cyber-Security Deception To Manipulation and Gratification Through Gamification