Machine Learning Approach to Automate Decision Support on Information System Attacks

Abstract

As more software solutions are now cloud based taking advantage of the powerful computing performance of remote servers and super computers, the machine learning industry is also switching to this technology providing promising solutions such as Google Cloud Artificial Intelligence, Amazon Web Services, and Microsoft Azure Machine Learning. With the adoption of the cloud technology for nowadays computer transactions and operations, a cloud IDS solution that can compete with the emerging technology challenges is crucially needed to help network administrators secure data and prevent any intrusions. The machine learning approaches often require high computing performance and gigantic memory space to process mega datasets and come up with better prediction results. This paper introduces a new aspect of using cloud-based machine learning solution as an online computing resource for the application of machine learning concepts to predict intrusions in IDS systems based on network packet behavior, while the traditional way is to use local computer resources through data mining solutions such as Weka or Orange. We used Microsoft Azure Machine Learning Studio along with CSE-CIC-IDS 2018 dataset from the Canadian Institute for Cyber Security to apply various techniques and algorithms to come up with a powerful network model. The aim of this paper is to explain how a cloud-based data mining tool can be used for its better performance and high accuracy for data mining and building a strong intrusion detection system. As a start point, we used a saved dataset that contains a collection of anomaly detection records applied on an IDS while various attributes are registered. To differentiate between normal and anomalous traffic, two profiles are used: B-profile and M- profile to generate benign and malicious traffic respectively in the network.