Logo image
Back
Extended Isolation Forest for Intrusion Detection in Zeek Data
Journal article   Open access   Peer reviewed

Extended Isolation Forest for Intrusion Detection in Zeek Data

Fariha Moomtaheen, Sikha S. Bagui, Subhash C. Bagui and Dustin Mink
Information (Basel), Vol.15(7), p.404
07/12/2024
DOI: https://doi.org/10.3390/info15070404
Web of Science ID: WOS:001277623500001

Metrics

34 Record Views
5 Times Cited - Web of Science

Abstract

The novelty of this paper is in determining and using hyperparameters to improve the Extended Isolation Forest (EIF) algorithm, a relatively new algorithm, to detect malicious activities in network traffic. The EIF algorithm is a variation of the Isolation Forest algorithm, known for its efficacy in detecting anomalies in high-dimensional data. Our research assesses the performance of the EIF model on a newly created dataset composed of Zeek Connection Logs, UWF-ZeekDataFall22. To handle the enormous volume of data involved in this research, the Hadoop Distributed File System (HDFS) is employed for efficient and fault-tolerant storage, and the Apache Spark framework, a powerful open-source Big Data analytics platform, is utilized for machine learning (ML) tasks. The best results for the EIF algorithm came from the 0-extension level. We received an accuracy of 82.3% for the Resource Development tactic, 82.21% for the Reconnaissance tactic, and 78.3% for the Discovery tactic.
url
Extended Isolation Forest for Intrusion Detection in Zeek Data View
Published (Version of record)link to articleCC BY V4.0,  Open

Related links

Details

Logo image