Authors: Protić, Danijela
Gaur, Loveleen
Stanković, Miomir 
Rahman, Md Anisur
Affiliations: Mathematical Institute of the Serbian Academy of Sciences and Arts 
Title: Cybersecurity in Smart Cities: Detection of Opposing Decisions on Anomalies in the Computer Network Behavior
Journal: Electronics
Volume: 11
Issue: 22
First page: 3718
Issue Date: 2022
Rank: ~M22
ISSN: 2079-9292
DOI: 10.3390/electronics11223718
The increased use of urban technologies in smart cities brings new challenges and issues. Cyber security has become increasingly important as many critical components of information and communication systems depend on it, including various applications and civic infrastructures that use data-driven technologies and computer networks. Intrusion detection systems monitor computer networks for malicious activity. Signature-based intrusion detection systems compare the network traffic pattern to a set of known attack signatures and cannot identify unknown attacks. Anomaly-based intrusion detection systems monitor network traffic to detect changes in network behavior and identify unknown attacks. The biggest obstacle to anomaly detection is building a statistical normality model, which is difficult because a large amount of data is required to estimate the model. Supervised machine learning-based binary classifiers are excellent tools for classifying data as normal or abnormal. Feature selection and feature scaling are performed to eliminate redundant and irrelevant data. Of the 24 features of the Kyoto 2006+ dataset, nine numerical features are considered essential for model training. Min-Max normalization in the range [0,1] and [−1,1], Z-score standardization, and new hyperbolic tangent normalization are used for scaling. A hyperbolic tangent normalization is based on the Levenberg-Marquardt damping strategy and linearization of the hyperbolic tangent function with a narrow slope gradient around zero. Due to proven classification ability, in this study we used a feedforward neural network, decision tree, support vector machine, k-nearest neighbor, and weighted k-nearest neighbor models Overall accuracy decreased by less than 0.1 per cent, while processing time was reduced by more than a two-fold reduction. The results show a clear benefit of the TH scaling regarding processing time. Regardless of how accurate the classifiers are, their decisions can sometimes differ. Our study describes a conflicting decision detector based on an XOR operation performed on the outputs of two classifiers, the fastest feedforward neural network, and the more accurate but slower weighted k-nearest neighbor model. The results show that up to 6% of different decisions are detected.
Keywords: anomaly detection | binary classification | feature scaling | machine learning
Publisher: MDPI

Files in This Item:
File Description SizeFormat
MStankovic.pdf752.71 kBAdobe PDFView/Open
Show full item record


checked on May 20, 2024

Page view(s)

checked on May 9, 2024


checked on May 9, 2024

Google ScholarTM




This item is licensed under a Creative Commons License Creative Commons