Research article Special Issues

A two-stage intrusion detection method based on light gradient boosting machine and autoencoder


  • Intrusion detection systems can detect potential attacks and raise alerts on time. However, dimensionality curses and zero-day attacks pose challenges to intrusion detection systems. From a data perspective, the dimensionality curse leads to the low efficiency of intrusion detection systems. From the attack perspective, the increasing number of zero-day attacks overwhelms the intrusion detection system. To address these problems, this paper proposes a novel detection framework based on light gradient boosting machine (LightGBM) and autoencoder. The recursive feature elimination (RFE) method is first used for dimensionality reduction in this framework. Then a focal loss (FL) function is introduced into the LightGBM classifier to boost the learning of difficult samples. Finally, a two-stage prediction step with LightGBM and autoencoder is performed. In the first stage, pre-decision is conducted with LightGBM. In the second stage, a residual is used to make a secondary decision for samples with a normal class. The experiments were performed on the NSL-KDD and UNSWNB15 datasets, and compared with the classical method. It was found that the proposed method is superior to other methods and reduces the time overhead. In addition, the existing advanced methods were also compared in this study, and the results show that the proposed method is above 90% for accuracy, recall, and F1 score on both datasets. It is further concluded that our method is valid when compared with other advanced techniques.

    Citation: Hao Zhang, Lina Ge, Guifen Zhang, Jingwei Fan, Denghui Li, Chenyang Xu. A two-stage intrusion detection method based on light gradient boosting machine and autoencoder[J]. Mathematical Biosciences and Engineering, 2023, 20(4): 6966-6992. doi: 10.3934/mbe.2023301

    Related Papers:

    [1] Jiaxin Shen, Yuqing Xia . Flag-transitive 2-designs with block size 5 and alternating groups. AIMS Mathematics, 2025, 10(5): 10308-10323. doi: 10.3934/math.2025469
    [2] Yongli Zhang, Jiaxin Shen . Flag-transitive non-symmetric 2-designs with λ prime and exceptional groups of Lie type. AIMS Mathematics, 2024, 9(9): 25636-25645. doi: 10.3934/math.20241252
    [3] Simone Costa, Marco Pavone . Orthogonal and oriented Fano planes, triangular embeddings of K7, and geometrical representations of the Frobenius group F21. AIMS Mathematics, 2024, 9(12): 35274-35292. doi: 10.3934/math.20241676
    [4] Menderes Gashi . On the symmetric block design with parameters (280,63,14) admitting a Frobenius group of order 93. AIMS Mathematics, 2019, 4(4): 1258-1273. doi: 10.3934/math.2019.4.1258
    [5] Hengbin Zhang . Automorphism group of the commuting graph of 2×2 matrix ring over Zps. AIMS Mathematics, 2021, 6(11): 12650-12659. doi: 10.3934/math.2021729
    [6] Yang Zhang, Shuxia Liu, Liwei Zeng . A symplectic fission scheme for the association scheme of rectangular matrices and its automorphisms. AIMS Mathematics, 2024, 9(11): 32819-32830. doi: 10.3934/math.20241570
    [7] Dong Su, Shilin Yang . Automorphism groups of representation rings of the weak Sweedler Hopf algebras. AIMS Mathematics, 2022, 7(2): 2318-2330. doi: 10.3934/math.2022131
    [8] Carlo Morpurgo, Liuyu Qin . Moser-Trudinger inequalities on 2-dimensional Hadamard manifolds. AIMS Mathematics, 2024, 9(7): 19670-19676. doi: 10.3934/math.2024959
    [9] Muhsin Incesu . LS (3)-equivalence conditions of control points and application to spatial Bézier curves and surfaces. AIMS Mathematics, 2020, 5(2): 1216-1246. doi: 10.3934/math.2020084
    [10] Zaffar Iqbal, Xiujun Zhang, Mobeen Munir, Ghina Mubashar . Hilbert series of mixed braid monoid MB2,2. AIMS Mathematics, 2022, 7(9): 17080-17090. doi: 10.3934/math.2022939
  • Intrusion detection systems can detect potential attacks and raise alerts on time. However, dimensionality curses and zero-day attacks pose challenges to intrusion detection systems. From a data perspective, the dimensionality curse leads to the low efficiency of intrusion detection systems. From the attack perspective, the increasing number of zero-day attacks overwhelms the intrusion detection system. To address these problems, this paper proposes a novel detection framework based on light gradient boosting machine (LightGBM) and autoencoder. The recursive feature elimination (RFE) method is first used for dimensionality reduction in this framework. Then a focal loss (FL) function is introduced into the LightGBM classifier to boost the learning of difficult samples. Finally, a two-stage prediction step with LightGBM and autoencoder is performed. In the first stage, pre-decision is conducted with LightGBM. In the second stage, a residual is used to make a secondary decision for samples with a normal class. The experiments were performed on the NSL-KDD and UNSWNB15 datasets, and compared with the classical method. It was found that the proposed method is superior to other methods and reduces the time overhead. In addition, the existing advanced methods were also compared in this study, and the results show that the proposed method is above 90% for accuracy, recall, and F1 score on both datasets. It is further concluded that our method is valid when compared with other advanced techniques.



    It is well-known that a Hadamard matrix of order n can exist only if n = 1, 2 or n0mod4. The Hadamard conjecture states that these necessary conditions are also sufficient. Since the discovery of a Hadamard matrix of order 428, the smallest open case is n = 668 (see [22]). In this paper, Hadamard matrices of order 52 and 60 are obtained. In the literature, there are many studies concerning this order and we mention few of them. In [23], the authors were interested in a construction of Hadamard matrices of order 52, and in [24], the authors established the new lower bound for Hadamard matrices of order 60. In [6], the authors obtained many new Hadamard matrices of order 60 via the genetic algorithm. In [14], the author constructed many new inequivalent Hadamard matrices of order 60.

    The existence of Hadamard 2-(51,25,12) designs and Hadamard 2-(59,29,14) designs is known (see [7]), but the classification of designs with these parameters is not. In [1], the authors classify designs with parameters 2-(59,29,14) having an automorphism group of order 29 and one fixed point and show that there are exactly 531 such designs. The classification of designs with particular parameters is one of the most important topics in design theory. The Hadamard designs with parameters 2-(51,25,12) and 2-(59,29,14) assuming the action of the Frobenius groups of order 10 and 14 have not been studied before. This result gives a contribution to the studies of designs from group theory point of view. However, according to our best knowledge, in [7] there is information that the number of known Hadamard 2-(51,25,12) is 1. We increase the number by constructing 17 new Hadamard 2-(51,25,12) designs. Moreover, in this paper, we constructed 32 new Hadamard 2-(59,29,14) designs, non-isomorphic to the ones obtained in [1].

    In this paper, we show that, up to isomorphism, there are exactly 17 Hadamard 2-(51,25,12) designs having a non-abelian automorphism group of order 10, i.e., Frob10Z5:Z2, where a subgroup isomorphic to Z2 fixes setwise all the Z5-orbits of the sets of points and blocks. Moreover, we show that there are exactly 32 pairwise non-isomorphic Hadamard 2-(59,29,14) designs having a non-abelian automorphism group of order 14, i.e., Frob14Z7:Z2, where an involution fixes setwise all the Z7-orbits of the sets of points and blocks. Further, we show that there is no Hadamard 2-(59,29,14) design with automorphism group Frob21Z7:Z3, where a subgroup isomorphic to Z3 fixes setwise all the Z7-orbits of points and blocks. From the Hadamard designs obtained, we construct 9 pairwise nonequivalent Hadamard matrices of order 52 and 8 pairwise nonequivalent Hadamard matrices of order 60. From the Hadamard matrices of order 60, we construct ternary self-dual codes and self-dual codes over the finite field of order 5.

    The paper is organized as follows. In Section 2, we give basic definitions and properties of designs, Hadamard matrices, and linear codes, and explain the method of constructing designs used in this paper. In Section 3, we give constructions of Hadamard 2-(51,25,12) designs, while in Section 4 we give constructions of Hadamard 2-(59,29,14) designs. In Section 5, we study codes from constructed Hadamard 2-(59,29,14) designs and the corresponding Hadamard matrices.

    Computer calculations in this paper were done by programs written for the system for computational discrete algebra GAP [15], and Magma [4]. The programs are tested on the orbit matrices and designs obtained in [5] and [9] by repeating the calculations given in these references. Each calculation is repeated at least twice to test the correct work of the software.

    The designs and the orbit matrices constructed in this paper can be found at https://math.uniri.hr/ddumicic/results/Des51-59_Had52-60.html

    We assume that the reader is familiar with the basic facts of design theory and coding theory. We refer the reader to [3,7] for the relevant reading in design theory and to [19] for the relevant reading in coding theory.

    A 2-(v,k,λ) design is a finite incidence structure D=(P,B,I), where P and B are disjoint sets and IP×B, with the following properties:

    1. |P|=v and 1<k<v1,

    2. every element (block) of B is incident with exactly k elements (points) of P,

    3. every two distinct points in P are together incident with exactly λ blocks of B.

    In a 2-(v,k,λ) design, every point is incident with exactly r=λ(v1)k1 blocks, and r is called the replication number of a design. A 2-design is also called a block design. The number of blocks in a block design is denoted by b. If v=b, a design is called symmetric. In a symmetric design, each two blocks meet in exactly λ points. In case of symmetric designs, the notation (v,k,λ) design is often used. An isomorphism from one block design to another is a bijective mapping of points to points and blocks to blocks, which preserves incidence. An isomorphism from a block design D onto itself is called an automorphism of D. The set of all automorphisms forms a group called the full automorphism group of D and is denoted by Aut(D). If D is a block design, the incidence structure D having as points the blocks of D, and having as blocks the points of D, where a point and a block are incident in D if, and only if, the corresponding block and a point of D are incident, is a block design called the dual of D. The design is called self-dual if the design and its dual are isomorphic.

    If D is a symmetric design and GAut(D), then the action of G on D induces the same number of orbits of the set of points and blocks, and G fixes the same number of points and blocks. Furthermore, each automorphism gG has the same cyclic structure considered as a permutation on points or on blocks. We say that a group G acts semi-standardly on D if the point orbit lengths distribution is equal to the block orbit lengths distribution, and G acts standardly on D if every point orbit has length 1 or |G|. For further reading on symmetric designs and their automorphism groups, we refer the reader to [25,26]. We state the following propositions that will be used later, and they can be found in [25].

    Proposition 2.1. Let α1 be an automorphism of a symmetric 2-(v,k,λ) design which fixes Fα points. Then

    Fαv2nandFαλknv,

    where n=kλ. Moreover, if equality holds in either inequality, α must be an involution and every non-fixed block contains exactly λ fixed points.

    Proposition 2.2. Let D be a symmetric 2-(v,k,λ) design and αAut(D). If α is an involution fixing Fα0 points, then

    Fα{1+kλ, fork,λeven,1+k1λ, otherwise.

    A Hadamard matrix of order n is a n×n (1,1)-matrix H such that HH=nIn. Two Hadamard matrices are said to be equivalent if one can be transformed into the other by a series of row and column permutations and negations. A Hadamard matrix is normalized if all entries in the first row and the first column are 1. Hence, every Hadamard matrix is equivalent to a normalized Hadamard matrix.

    Hadamard matrices are closely related to designs. Hadamard matrices of order 4t can be used to obtain symmetric 2-designs with parameters (4t1,2t1,t1) or (4t1,2t,t), which are called Hadamard 2-designs (see [8]). The construction is reversible, i.e., from symmetric 2-designs with these parameters, one can construct Hadamard matrices.

    A q-ary linear code C of dimension k for a prime power q is a k-dimensional subspace of a vector space Fnq. Elements of C are called codewords. If q=2, a code C is called binary, and for q=3, a code is called ternary. Let x=(x1,...,xn) and y=(y1,...,yn)Fnq. The Hamming distance between words x and y is the number d(x,y)=|{i:xiyi}|. The minimum distance of the code C is defined by d=min{d(x,y):x,yC, xy}. The weight of a codeword x is w(x)=d(x,0)=|{i:xi0}|. A code for which all codewords have weight divisible by four is called doubly-even, and singly even if all weights are even and there is at least one codeword x with w(x)2mod4. For a linear code, d=min{w(x):xC,x0}. A q-ary linear code of length n, dimension k, and distance d is called a [n,k,d]q code. We may use the notation [n,k] if the parameters d and q are unspecified. The dual code C is the orthogonal complement under the standard inner product, i.e., ,, i.e. C={vFnq:v,c=0 for all cC}. A code C is self-orthogonal if CC and self-dual if C=C. A ternary self-dual code of length n exists if, and only if, n is divisible by four. We say that a code is optimal if it has the largest minimum weight among all codes of that length and dimension.

    P. Dembowski introduced the notion of a tactical decomposition of an incidence structure and showed that the orbits of an automorphism group acting on an incidence structure I induce a tactical decomposition of I (see [12]). Tactical decompositions induced by the action of an automorphism group leads us to orbit matrices of incidence structures, which have been successfully used for a construction of block designs for more than 40 years; see for example, in [9,10,11,20,21]. The designs constructed in this paper are obtained using orbit matrices of symmetric designs. The first step of the method is the construction of orbit matrices for the assumed action of an automorphism group on a design, and the second step is the construction of incidence matrices of designs from the obtained orbit matrices. This second step is often called the indexing of orbit matrices. We briefly describe the construction of designs, but more details about this construction can be found in [20].

    Let D be a 2-(v,k,λ) design and GAut(D). We denote G-orbits of points and blocks by P1,,Pm and B1,,Bn, respectively, and put |Pi|=ωi, |Bj|=Ωj, 1im, 1jn. It holds that mi=1ωi=v, and also nj=1Ωj=b.

    Further, by tij we denote the number of blocks in Bj incident with the representative of the point orbit Pi, i.e., tij=|{BBj | (P,B)I, PPi}|. Analogously, bij is the number of points in Pi incident with the representative of the block orbit Bj, i.e., bij=|PPi | (P,B)I, BBj|. The numbers tij and bij do not depend on the choice of the representatives of point and block orbits, respectively.

    The following conditions for tij hold (see [10] and [20]):

    0tijΩj,1im,  1jn, (2.1)
    nj=1tij=r,1im, (2.2)
    mi=1ωiΩjtij=k,1jn, (2.3)
    nj=1ωsΩjtsjtsj=λωs+δss(rλ),1s,sm. (2.4)

    A (m×n) matrix T=[tij] with entries satisfying conditions (2.1)(2.4) is called apoint orbit matrix of a 2-(v,k,λ) design with orbit lengths distributions (ω1,,ωm) and (Ω1,,Ωn). A (l×n) matrix [tij], for l<m, with entries satisfying conditions (2.1), (2.2), (2.4), and the condition

    li=1ωiΩjtijk,1jn,

    is called a partial point orbit matrix of a 2-(v,k,λ) design with orbit lengths distributions (ω1,,ωm) and (Ω1,,Ωn).

    If D is a symmetric 2-(v,k,λ) design, then also the following equation holds:

    mi=1ωiΩstistit=λΩt+δst(rλ),  1s,tn. (2.5)

    The set of indices of blocks in a G-orbit Bj indicating which blocks of Bj are incident with the representative of a G-orbit of points Pi is called the index set for an entry tij in a point orbit matrix, for i{1,m} and j{1,,n}.

    In the construction of (partial) orbit matrices, it is very useful to reduce the number of those from which isomorphic designs are constructed. This is achieved through appropriate permutations of rows and columns, as stated in the following proposition (see [10, Theorem 4]).

    Proposition 2.3. Let D=(P,B,I) be a 2-(v,k,λ) design, GAut(D), and let the (m×n) matrix T be a point orbit matrix of the design D with respect to the group G. Then, let g=(α,β)S=Sm×Sn with the following properties:

    1. if α(s)=t, then the stabilizer GPs is conjugate to GPt, where Ps,PtP, Ps=PsG, and Pt=PtG,

    2. if β(i)=j, then Gxi is conjugate to Gxj, where xi,xjB, Bi=xiG, Bj=xjG.

    Then, there exists a permutation gCS(P)×S(B)(G), such that

    α(s)=t if, and only if,  g(Ps)=Pt, and
    β(i)=j if, and only if,  g(Bi)=Bj.

    Two orbit matrices T and T are isomorphic if there is a permutation g=(α,β)Sm×Sn from T onto T=Tg that satisfies the conditions from Proposition 2.3. Isomorphic orbit matrices correspond to isomorphic designs. Hence, while constructing designs from orbit matrices, it is sufficient to construct designs from one orbit matrix from each isomorphism class of orbit matrices. So, during the construction of (partial) orbit matrices, for the isomorph rejection we used the isomorphisms of (partial) orbit matrices. For more details on this, we refer to [5] and [10].

    In this section, we construct Hadamard 2-(51,25,12) designs having an automorphism group Frob10D10. To analyze the action of a non-abelian group Frob10Z5:Z2 on a 2-(51,25,12) design, first we examine the action of its subgroup Z5 on that design and obtain the result given in the following proposition.

    Proposition 3.1. If an automorphism ρ of order 5 acts on a 2-(51,25,12) design, then it fixes exactly one point.

    Proof. If a 2-(51,25,12) design D admits an action of an automorphism ρ of order 5, then the number of points fixed by ρ is Fρ{1,6,11,16,21}, since ρ acts on the set of points (and blocks) of D in orbits of length 1 or 5. By Proposition 2.1, it holds that Fρ25.

    If Fρ=6, then the ρ-orbit lengths distribution is (ω1,,ω15) = (Ω1,,Ω15) = (1,1,1,1,1,1,5,5,5,5,5,5,5,5,5). In this case, each point fixed by ρ is incident with 0 or 5 fixed blocks, since r=25. Let P be a fixed point which is not incident with a fixed block. Then, the point P together with each of the other 5 fixed points is incident with 5, 10, 15, 20, or 25 non-fixed blocks, which is a contradiction, since λ=12. Hence, each fixed point is incident with 5 fixed blocks. Furthermore, any pair of fixed points are contained in 4 or 5 common fixed blocks, and in 5y, y{0,1,,4}, common non-fixed blocks. It yields to a contradiction since λ=12.

    It is easy to check that for Fρ{11,16,21}, there are no candidates for a row in a point orbit matrix corresponding to an ρ-orbit with non-fixed points that satisfies the properties (2.1), (2.2), and (2.4), for s=s. For example, if Fρ=21, then Ω1=Ω2==Ω21=1 and Ω22=Ω23==Ω27=5. For s{22,23,,27}, the equation

    5(t2s1+t2s2++t2s21)+t2s22+t2s23++t2s27=73

    does not have a solution for ts1,ts2,,ts21{0,1} and ts22,ts23,,ts27{0,1,2,3,4,5}, under assumption that 27j=1tsj=25.

    Therefore, it holds that Fρ=1.

    Hence, an automorphism ρ of order 5 acts standardly on a 2-(51,25,12) design with the orbit lengths distribution (ω1,,ω11)=(1,5,5,5,5,5,5,5,5,5,5). It is easy to see that there is only one candidate for the first row in a point orbit matrix that represents the point fixed by ρ, which is [0,5,5,5,5,5,0,0,0,0,0] (up to permutations of columns that correspond to the block orbits of the same length). Further, all possible candidates for rows from second to eleventh in a point orbit matrix (up to permutations of columns that correspond to the block orbits of the same length) that correspond to ρ-orbits with non-fixed points are listed in Table 1. They satisfy the properties (2.1), (2.2), and (2.4), for s=s. Note that these candidates for rows are called types in [5].

    Table 1.  Candidates for rows in a point orbit matrix.
    1) [1,5,3,3,2,2,2,2,2,2,1] 7) [0,5,3,3,3,2,2,2,2,2,1]
    2) [1,4,4,3,3,2,2,2,2,1,1] 8) [0,4,4,4,2,2,2,2,2,2,1]
    3) [1,4,3,3,3,3,3,2,1,1,1] 9) [0,4,4,3,3,3,2,2,2,1,1]
    4) [1,4,3,3,3,3,2,2,2,2,0] 10) [0,4,3,3,3,3,3,3,1,1,1]
    5) [1,3,3,3,3,3,3,3,2,1,0] 11) [0,4,3,3,3,3,3,2,2,2,0]
    6) [0,5,4,2,2,2,2,2,2,2,2] 12) [0,3,3,3,3,3,3,3,3,1,0]

     | Show Table
    DownLoad: CSV

    After determining the candidates for rows of a point orbit matrix, we proceed with the construction of point orbit matrices following the algorithm given in [5].

    Using our program written for GAP, we constructed 528 pairwise non-isomorphic point orbit matrices for the action of an automorphism of order 5 on a 2-(51,25,12) design D. Here, for isomorph rejection we used all permutations of rows and columns of (partial) point orbit matrices that correspond to the orbits of the same length, i.e., that satisfy the conditions from Proposition 2.3. We checked whether the constructed point orbit matrices are mutually non-isomorphic by using the GAP function TransformingPermutations. This is summarized in the following theorem.

    Theorem 3.2. Up to isomorphism, there are exactly 528 point orbit matrices for an action of an automorphism of order 5 on a 2-(51,25,12) design.

    We assume that the group G=ρ,α | ρ5=α2=1, αρα=ρ1Frob10 acts on a Hadamard 2-(51,25,12) design in such a way that the involution α fixes the ρ-orbits of points and blocks setwise. To proceed with the construction of the designs admitting such action of the group GAut(D), while indexing the obtained orbit matrices, we may assume that its subgroup α<G stabilizes the representatives of all ρ-orbits of points and blocks. Since we assumed that α stabilizes the representatives of all orbits for the action of an automorphism ρ of order 5 on a 2-(51,25,12) design (i.e., all ρ-orbits are also G-orbits), involution α acts on the set of indices of a ρ-orbit of non-fixed points (and non-fixed blocks) in one of the following ways:

    α={(0)(1,4)(2,3)(0)(1)(2)(3)(4). (3.1)

    If α=(0)(1,4)(2,3) is the action of α on the index set of a point ρ-orbit {P0,P1,,P4} and a block ρ-orbit {B0,B1,,B4}, then the possibilities for the first rows of the corresponding part of an incidence matrix of D are as given in Table 2. The other four can be obtained by their cyclic permutations.

    Table 2.  Indexing of tij for the group G acting on D, α=(0)(14)(23).
    tij Possibilities for indexing the first rows tij Possibilities for indexing the first rows
    0 [0,0,0,0,0] 3 [1,1,0,0,1], [1,0,1,1,0]
    1 [1,0,0,0,0] 4 [0,1,1,1,1]
    2 [0,1,0,0,1], [0,0,1,1,0] 5 [1,1,1,1,1]

     | Show Table
    DownLoad: CSV

    A group acts transitively on each of its orbit, and it is known that a transitive action of a group on a set is permutation isomorphic to the action of the group on the cosets of the stabilizer of an element of the set; for example, see [13]. Let ρ and α be elements of orders 5 and 2, respectively, in D10. The group D10 has two conjugacy classes of nontrivial subgroups, which are of orders 2 and 5. Thus, there are three ways in which D10 acts as a nontrivial permutation group: the regular action on 10 points, the standard action on 5 points, and an action on 2 points where elements of order 2 act nontrivially and the cyclic subgroup of order 5 is in the kernel. Hence, the following proposition holds.

    Proposition 3.3. Let D be a 2-(51,25,12) design having a non-abelian automorphism group G=ρ,α | ρ5=α2=1, αρα=ρ1 of order 10. If G acts on the set of points of D with the orbit lengths distribution (1,5,5,5,5,5,5,5,5,5,5) (i.e., all ρ-orbits are also G-orbits), then α fixes exactly 11 points.

    The next step in the construction of designs is the indexing of the obtained orbit matrices, i.e., the construction of 2-(51,25,12) designs for the described action of G. The indexing of the point orbit matrices constructed for the action of an automorphism of order 5 was carried out quickly, by using Table 2 and checking if any pair of points is incident λ=12 common blocks. Finally, after eliminating isomorphic copies in the set of 480 constructed designs (using GAP function IsIsomorphicBlockDesign), we complete the classification and summarize the above results in the following theorem.

    Theorem 3.4. Up to isomorphism, there are exactly 17 Hadamard 2-(51,25,12) designs having an automorphism group G=ρ,α | ρ5=α2=1, αρα=ρ1, where an involution fixes setwise all the ρ-orbits of the sets of points and blocks. The G-orbit lengths distribution on the set of points (and blocks) of those designs is (1,5,5,5,5,5,5,5,5,5,5). Among the 17 constructed designs D1,,D17 there are 9 self-dual and 4 pairs of dual designs. Their full automorphism groups are given in Table 3. Up to equivalence, these 17 designs yield 9 Hadamard matrices of order 52.

    Table 3.  The full automorphism groups of designs D1,,D17.
    |Aut(D)| Description Design
    600 E25:(Z4×S3) D1
    40 Z2×(Z5:Z4) D2,D8,D9,D10,D16,D17
    100 E25:Z4 D3,D4,D11,D12
    20 Z5:Z4 D5,D7,D14,D15
    10 D10 D6,D13

     | Show Table
    DownLoad: CSV

    Similarly as in Section 3, we examine actions of a non-abelian group Frob14Z7:Z2 and Frob21Z7:Z3 on a 2-(59,29,14) design. First, we take a look at the action of an automorphism of order 7 on a 2-(59,29,14) design.

    Proposition 4.1. If an automorphism σ of order 7 acts on a 2-(59,29,14) design, then it fixes exactly three points.

    Proof. If σ is an automorphism of order 7 acting on a 2-(51,25,12) design D, then the number of points fixed by σ is Fσ{3,10,17,24}, since σ acts on the set of points (and blocks) of D in orbits of length 1 or 7. By Proposition 2.1, it holds that Fσ29. However, it is easy to check that for Fσ{10,17,24}, there are no candidates for a row in a point orbit matrix corresponding to an σ-orbit of non-fixed points that satisfies the properties (2.1), (2.2), and (2.4), for s=s. Therefore, it holds that Fσ=3.

    Hence, by Proposition 4.1, an automorphism σ of order 7 acts on a 2-(59,29,14) design with the orbit lengths distribution (ω1,,ω11)=(1,1,1,7,7,7,7,7,7,7,7). It is easy to see that there is only one candidate for the rows in a point orbit matrix that represent the points fixed by σ, which is [1,0,0,7,7,7,7,0,0,0,0] (up to permutations of columns that correspond to the block orbits of the same length). Also, all possible candidates for the rows in a point orbit matrix that correspond to σ-orbits of non-fixed points (up to permutations of columns that correspond to the block orbits of the same length) are listed in Table 4. They satisfy the properties (2.1), (2.2), and (2.4), for s=s.

    Table 4.  Candidates for rows in a point orbit matrix.
    1) [ 1, 1, 1, 5, 4, 4, 3, 3, 3, 2, 2] 9) [ 1, 0, 0, 5, 5, 4, 3, 3, 3, 3, 2 ]
    2) [ 1, 1, 1, 4, 4, 4, 4, 4, 2, 2, 2 ] 10) [ 1, 0, 0, 5, 4, 4, 4, 4, 3, 2, 2 ]
    3) [ 1, 1, 1, 4, 4, 4, 4, 3, 3, 3, 1] 11) [ 1, 0, 0, 4, 4, 4, 4, 4, 4, 3, 1 ]
    4) [ 1, 1, 0, 6, 3, 3, 3, 3, 3, 3, 3 ] 12) [ 0, 0, 0, 6, 4, 4, 3, 3, 3, 3, 3 ]
    5) [ 1, 1, 0, 5, 5, 3, 3, 3, 3, 3, 2 ] 13) [ 0, 0, 0, 5, 5, 4, 4, 3, 3, 3, 2 ]
    6) [ 1, 1, 0, 5, 4, 4, 4, 3, 3, 2, 2 ] 14) [ 0, 0, 0, 5, 4, 4, 4, 4, 4, 2, 2 ]
    7) [ 1, 1, 0, 4, 4, 4, 4, 4, 3, 3, 1] 15) [ 0, 0, 0, 4, 4, 4, 4, 4, 4, 4, 1]
    8) [ 1, 0, 0, 6, 4, 3, 3, 3, 3, 3, 3 ]

     | Show Table
    DownLoad: CSV

    By using our program written for GAP, we constructed 18 pairwise non-isomorphic point orbit matrices for the action of an automorphism of order 7 on a 2-(59,29,14) design D. In this case as well, for isomorph rejection we used all permutations of rows and columns of (partial) point orbit matrices that correspond to the orbits of the same length, i.e., that satisfy the conditions from Proposition 2.3. We summarize this in the following theorem.

    Theorem 4.2. Up to isomorphism, there are exactly 18 point orbit matrices for an action of an automorphism of order 7 on a 2-(59,29,14) design.

    Let us assume that a non-abelian group H=σ,α | σ7=α2=1, ασα=σ1Frob14 acts on a 2-(59,29,14) design in such a way that an involution fixes σ-orbits of points and blocks setwise. In other words, all σ-orbits are also H-orbits. As in Section 3, here we assume that the subgroup αZ2 of HAut(D) stabilizes the representatives of all σ-orbits of points and blocks. The following proposition can be proven in a similar way as Proposition 3.3.

    Proposition 4.3. Let D be a 2-(59,29,14) design having a non-abelian automorphism group H=σ,α | σ7=α2=1, ασα=σ1 of order 14. If H acts on the set of points (and blocks) with the orbit lengths distribution (1,1,1,7,7,7,7,7,7,7,7), then α fixes exactly 11 points.

    Therefore, α acts on the set of indices of all σ-orbit of non-fixed points (and non-fixed blocks) as

    α=(0)(1,6)(2,5)(3,4). (4.1)

    Further, the corresponding element tij in a point orbit matrix for the described action of H on D can be indexed in a few ways, as given in Table 5. Only the first rows are listed, since the other six can be obtained by their cyclic permutations.

    Table 5.  Indexing of tij for the group H acting on D.
    tij Possibilities for indexing the first rows tij Possibilities for indexing the first rows
    1 [1,0,0,0,0,0,0] 4 [0,1,1,0,0,1,1], [0,1,0,1,1,0,1], [0,0,1,1,1,1,0]
    2 [0,1,0,0,0,0,1], [0,0,1,0,0,1,0], [0,0,0,1,1,0,0] 5 [1,1,1,0,0,1,1], [1,1,0,1,1,0,1], [1,0,1,1,1,1,0]
    3 [1,1,0,0,0,0,1], [1,0,1,0,0,1,0], [1,0,0,1,1,0,0] 6 [0,1,1,1,1,1,1]

     | Show Table
    DownLoad: CSV

    The last step is indexing of the obtained orbit matrices, i.e., the construction of 2-(59,29,14) designs for the assumed action of H. The indexing of the point orbit matrices constructed for the action of an automorphism of order 7 was carried out very quickly, by using Table 5 and by checking if any pair of points is incident with λ=14 common blocks. In this way, we construct all Hadamard 2-(59,29,14) designs admitting the described action of the automorphism group H. After eliminating isomorphic copies in the set of 96 constructed designs, we complete the classification and summarize the above results in the following theorem.

    Theorem 4.4. Let D be a 2-(59,29,14) design having a non-abelian automorphism group H=σ,α | σ7=α2=1, ασα=σ1 of order 14. If the involution α fixes setwise all the σ-orbits of points and blocks, then H acts on D with the orbit lengths distribution (1,1,1,7,7,7,7,7,7,7,7). Up to isomorphism, there are exactly 32 Hadamard 2-(59,29,14) designs admitting that action of H. Among them there are 16 pairs of dual designs and their full automorphism group is D28. Up to equivalence, these 32 designs yield 8 Hadamard matrices of order 60.

    Next, we analyze the action of a non-abelian group of order 21, i.e., HFrob21Z7:Z3 on a Hadamard 2-(59,29,14) design D, assuming that a subgroup of order 3 fixes setwise all the Z7-orbits of points and blocks. The 18 pairwise non-isomorphic point orbit matrices for the action of an automorphism of order 7 on a 2-(59,29,14) design are used here to prove the following proposition.

    Theorem 4.5. There does not exist a Hadamard 2-(59,29,14) design D having a non-abelian automorphism group H=σ,β | σ7=β3=1, βσβ=σ1Frob21 such that the automorphism β fixes setwise all the σ-orbits of points and blocks.

    Proof. By Proposition 4.1, the automorphism σ acts on D with the point orbit lengths distribution (1,1,1,7,7,7,7,7,7,7,7). Since we may assume that β stabilizes the representatives of all σ-orbits (i.e. σ-orbits are also H-orbits), the action of β on the set of indices of a σ-orbit of non-fixed points (and non-fixed blocks) is as follows:

    β=(0)(1,2,4)(3,6,5). (4.2)

    Since β=(0)(1,2,4)(3,6,5) is a representation of the action of β on the set of indices of a point σ-orbit {P0,P1,,P6} and a block σ-orbit {B0,B1,,B6}, then it is clear that the corresponding element tij in a point orbit matrix for the assumed action of H is

    tij{0,1,3,4,6,7}. (4.3)

    The automorphism β acts on every σ-orbit of non-fixed points OP (and non-fixed blocks) as the permutation β=(0)(1,2,4)(3,6,5). Hence, if the i-th row in a point orbit matrix for the assumed action of H on D is the one that corresponds to the orbit OP, then the elements tij, j{4,,11} must be from the set as denoted in (4.3). However, each of the 18 constructed pairwise non-isomorphic point orbit matrices contains an element equal to 2 or 5 in each row corresponding to an orbit with non-fixed points. This gives a contradiction with (4.3). Therefore, point orbit matrices for the assumed action of the group H on D do not exist.

    Codes obtained from Hadamard designs and Hadamard matrices gain a lot of attention among people working in coding theory. In this section, we use Hadamard 2-(59,29,14) designs and Hadamard matrices of order 60 obtained in this paper to construct linear codes. Recently, in [1,2,18], the authors were interested in self-dual ternary codes of length 60 obtained form Hadamard matrices and designs. In the aforementioned papers, the authors have studied extremal self-dual codes, while the codes that we constructed are not extremal. Further, in [27], the authors classify all optimal singly even self-dual codes with an automorphism of order 5 with 12 cycles, and in [17] the authors were interested in binary self-dual codes of length 60.

    It is well-known that designs with high degree of symmetry could produce codes with low dimension. If p is a prime, p-rank of the incidence matrix of a 2-(v,k,λ) design can be smaller than v1 only if p divides the order of a design, i.e., if p divides kλ in the case of a symmetric design (see [16]). For a symmetric 2-(59,29,14) design, the primes that could be of interest are 3 and 5, whereas for 2-(51,25,12), we obtain trivial results whenever p13. Ternary codes and codes over the finite field of order 5 spanned by incidence matrices of 2-(59,29,14) designs give raise to 8 non-equivalent ternary linear codes having the length 59 and dimension 30, i.e., linear codes with parameters [59,30]. In the cases of ternary codes, the best known minimal weight for [59,30]3 codes is 17, while in the case of the codes over the finite field of order 5, i.e., [59,30]5, is 18.

    The minimum weights of the constructed linear codes are presented in Table 6.

    Table 6.  Linear codes from 2-(59, 29, 14) designs.
    GF(q) C(Di) Minimum weight
    q=3 i=1,2,3,5 8
    q=3 i=6,8 11
    q=3 i=4,7 12
    q=5 i=1,2,3,4,5,8 12
    q=5 i=6,7 13

     | Show Table
    DownLoad: CSV

    Moreover, we construct ternary self-dual codes and self-dual codes over the finite field of order 5 spanned by the Hadamard matrices of order 60 obtained in this paper. Self-dual codes constructed from Hadamard matrices of order 60 with an automorphism group of order 29 were studied in [1].

    Ternary codes spanned by Hadamard matrices of order 60 give raise to 8 nonequivalent ternary self-dual codes having the length 60 and dimension 30, i.e., linear codes with parameters [60,30], and to 8 nonequivalent [60,30] linear codes over finite field of order 5. In the cases of ternary codes, the best known minimal weight for [60,30]3 codes is 18, while in the case of the codes over the finite field of order 5, i.e., [60,30]5, is 19.

    The minimum weights of constructed self-dual codes are presented in Table 7.

    Table 7.  Self-dual codes from Hadamard matrices of order 60.
    GF(q) C(Hi) Minimum weight
    q=3 i=4,6,7,8 9
    q=3 i=1,2,3,5 12
    q=5 i=2,3,4,5,7,8 12
    q=5 i=1,6 14

     | Show Table
    DownLoad: CSV

    This is a joint collaboration with all authors contributing substantially throughout.

    The authors declare they have not used Artificial Intelligence (AI) tools in the creation of this article.

    The authors would like to thank the reviewers for comments that improved the presentation of the paper. This work has been fully supported by Croatian Science Foundation under the project 4571 and 5713.

    The authors declare no conflict of interest.



    [1] An Article to Understand Ransomware Attacks: Characteristics, Trends and Challenges. Available from: https://www.secrss.com/articles/33928
    [2] D. J. Du, M. G. Zhu, M. R. Fei, M. Fei, S. Bu, L. Wu, et al., A Review on cybersecurity analysis, attack detection, and attack defense methods in cyber-physical power systems, J. Mod. Power Syst. Clean Energy, 2022 (2022), 1–18. https://doi.org/10.35833/MPCE.2021.000604 doi: 10.35833/MPCE.2021.000604
    [3] Ransomware Attack Forces Shutdown of Largest Fuel Pipeline in the U.S. Available from: https://www.cnbc.com/2021/05/08/colonial-pipeline-shuts-pipeline-operations-after-cyberattack.html
    [4] P. R. Kanna, P. Santhi, Unified deep learning approach for efficient intrusion detection system using integrated spatial–temporal features, Knowl. Based Syst., 226 (2021), 107132. https://doi.org/10.1016/j.knosys.2021.107132 doi: 10.1016/j.knosys.2021.107132
    [5] M. Bijone, A survey on secure network: intrusion detection & prevention approaches, Am. J. Inf. Syst., 4 (2016), 69–88. https://doi.org/10.12691/ajis-4-3-2 doi: 10.12691/ajis-4-3-2
    [6] A. Khraisat, I. Gondal, P. Vamplew, J. Kamruzzaman, Survey of intrusion detection systems: techniques, datasets and challenges, Cybersecurity, 2 (2019), 1–22. https://doi.org/10.1186/s42400-019-0038-7 doi: 10.1186/s42400-018-0018-3
    [7] A. Thakkar, R. Lohiya, A review of the advancement in intrusion detection datasets, Procedia Comput. Sci., 167 (2020), 636–645. https://doi.org/10.1016/j.procs.2020.03.330 doi: 10.1016/j.procs.2020.03.330
    [8] C. Guo, Y. Ping, N. Liu, S. S. Luo, A two-level hybrid approach for intrusion detection, Neurocomputing, 214 (2016), 391–400. https://doi.org/10.1016/j.neucom.2016.06.021 doi: 10.1016/j.neucom.2016.06.021
    [9] Intrusion Detection System. Available from: https://blog.51cto.com/u_12632800/4810474
    [10] I. F. Kilincer, F. Ertam, A. Sengur, Machine learning methods for cyber security intrusion detection: Datasets and comparative study, Comput. Networks, 188 (2021), 107840. https://doi.org/10.1016/j.comnet.2021.107840 doi: 10.1016/j.comnet.2021.107840
    [11] X. Xue, Y. Jia, Y. Tang, Expressway project cost estimation with a convolutional neural network model, IEEE Access, 8 (2020), 217848–217866. https://doi.org/10.1109/ACCESS.2020.3042329 doi: 10.1109/ACCESS.2020.3042329
    [12] N. Sameera, M. Shashi, Encoding approach for intrusion detection using PCA and KNN classifier, in Proceedings of the Third International Conference on Computational Intelligence and Informatics, 1090 (2020), 187–199. https://doi.org/10.1007/978-981-15-1480-7_15
    [13] J. Kevric, J. Samed, S. Abdulhamit, An effective combining classifier approach using tree algorithms for network intrusion detection, Neural Comput. Appl., 28 (2017), 1051–1058. https://doi.org/10.1007/s00521-016-2418-1 doi: 10.1007/s00521-016-2418-1
    [14] M. Yousefnezhad, J. Hamidzadeh, M. Aliannejadi, Ensemble classification for intrusion detection via feature extraction based on deep Learning, Soft Comput., 25 (2021), 12667–12683. https://doi.org/10.1007/s00500-021-06067-8 doi: 10.1007/s00500-021-06067-8
    [15] R. Swami, M. Dave, V. Ranga, Voting-based intrusion detection framework for securing software-defined networks, Concurrency Comput. Pract. Exper., 32 (2020), e5927. https://doi.org/10.1002/cpe.5927 doi: 10.1002/cpe.5927
    [16] A. Basati, M. M. Faghih, PDAE: Efficient network intrusion detection in IoT using parallel deep auto-encoders, Inf. Sci., 598 (2022), 57–74. https://doi.org/10.1016/j.ins.2022.03.065 doi: 10.1016/j.ins.2022.03.065
    [17] A. S. Almogren, Intrusion detection in edge-of-things computing, J. Parallel Distrib. Comput., 137 (2020), 259–265. https://doi.org/10.1016/j.jpdc.2019.12.008 doi: 10.1016/j.jpdc.2019.12.008
    [18] M. S. ElSayed, N. Le-Khac, M. A. Albahar, A. Jurcut, A novel hybrid model for intrusion detection systems in SDNs based on CNN and a new regularization technique, J. Network Comput. Appl., 191 (2021), 1–18. https://doi.org/10.1016/j.jnca.2021.103160 doi: 10.1016/j.jnca.2021.103160
    [19] N. Chouhan, A. Khan, Network anomaly detection using channel boosted and residual learning based deep convolutional neural network, Appl. Soft Comput., 83 (2019), 1–18. https://doi.org/10.1016/j.asoc.2019.105612 doi: 10.1016/j.asoc.2019.105612
    [20] G. Andresini, A. Appice, N. D. Mauro, C. Loglisci, D. Malerba, Exploiting the auto-encoder residual error for intrusion detection, in 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS & PW), (2019), 281–290. https://doi.org/10.1109/EuroSPW.2019.00038
    [21] R. C. Aygun, A. G. Yavuz, Network anomaly detection with stochastically improved autoencoder based models, in 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud), (2017), 192–198. https://doi.org/10.1109/CSCloud.2017.39
    [22] Y. Yang, K. Zheng, C. Wu, Y. Yang, Improving the classification effectiveness of intrusion detection by using improved conditional variational autoencoder and deep neural network, Sensors, 19 (2019), 2528. https://doi.org/10.3390/s19112528 doi: 10.3390/s19112528
    [23] B. Min, J. Yoo, S. Kim, D. Shin, Network anomaly detection using memory-augmented deep autoencoder, IEEE Access, 9 (2021), 104695–104706. https://doi.org/10.1109/ACCESS.2021.3100087 doi: 10.1109/ACCESS.2021.3100087
    [24] E. Mushtaq, A. Zameer, M. Umer, A. A. Abbas, A two-stage intrusion detection system with auto-encoder and LSTMs, Appl. Soft Comput., 121 (2022), 1–16. https://doi.org/10.1016/j.asoc.2022.108768 doi: 10.1016/j.asoc.2022.108768
    [25] M. Al-Qatf, Y. Lasheng, M. Al-Habib, K. Al-Sabahi, Deep learning approach combining sparse autoencoder with SVM for network intrusion detection, IEEE Access, 6 (2018), 52843–52856. https://doi.org/10.1109/ACCESS.2018.2869577 doi: 10.1109/ACCESS.2018.2869577
    [26] M. Belouch, S. E. Hadaj, M. Idhammad, A two-stage classifier approach using reptree algorithm for network intrusion detection, Int. J. Adv. Comput. Sci. Appl., 8 (2017), 389–394. https://doi.org/10.14569/IJACSA.2017.080651 doi: 10.14569/IJACSA.2017.080651
    [27] A. Javaid, W. Q. Sun, A. Y. Javaid, M. Alam, A deep learning approach for network intrusion detection system, in Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS), 3 (2016), 1–6. http://dx.doi.org/10.4108/eai.3-12-2015.2262516
    [28] L. X. Zhang, D. Ma, A hybrid approach toward efficient and accurate intrusion detection for in-vehicle networks, IEEE Access, 10 (2022), 10852–10866. http://dx.doi.org/10.1109/ACCESS.2022.3145007 doi: 10.1109/ACCESS.2022.3145007
    [29] J. Gu, L. H. Wang, H. W. Wang, S. S. Wang, A novel approach to intrusion detection using SVM ensemble with feature augmentation, Comput. Secur., 86 (2019), 53–62. https://doi.org/10.1016/j.cose.2019.05.022 doi: 10.1016/j.cose.2019.05.022
    [30] C. Ieracitano, A. Adeel, F. C. Morabito, A. Hussain, A novel statistical analysis and autoencoder driven intelligent intrusion detection approach, Neurocomputing, 387 (2020), 51–62. https://doi.org/10.1016/j.neucom.2019.11.016 doi: 10.1016/j.neucom.2019.11.016
    [31] H. Zhang, J. L. Li, X. M. Liu, C. Dong, Multi-dimensional feature fusion and stacking ensemble mechanism for network intrusion detection, Future Gener. Comput. Syst., 122 (2021), 130–143. https://doi.org/10.1016/j.future.2021.03.024 doi: 10.1016/j.future.2021.03.024
    [32] S. M. Kasongo, Y. X. Sun, Performance analysis of intrusion detection systems using a feature selection method on the UNSW-NB15 dataset, J. Big Data, 7 (2020), 1–20. https://doi.org/10.1186/s40537-020-00379-6 doi: 10.1186/s40537-019-0278-0
    [33] A. A. Megantara, T. Ahmad, A hybrid machine learning method for increasing the performance of network intrusion detection systems, J. Big Data, 8 (2021), 1–19. https://doi.org/10.1186/s40537-021-00531-w doi: 10.1186/s40537-020-00387-6
    [34] M. Rashid, J. Kamruzzaman, T. Imam, S. Wibowo, S. Gordon, A tree-based stacking ensemble technique with feature selection for network intrusion detection, Appl. Intell., 52 (2022), 1–14. https://doi.org/10.1007/s10489-021-02968-1 doi: 10.1007/s10489-021-02377-4
    [35] A. Chohra, P. Shirani, E. B. Karbab, M. Debbabi, Chameleon: Optimized feature selection using particle swarm optimization and ensemble methods for network anomaly detection, Comput. Secur., 117 (2022), 102684. https://doi.org/10.1016/j.cose.2022.102684 doi: 10.1016/j.cose.2022.102684
    [36] B. Y. Tama, M. Comuzzi, K. H. Rhee, TSE-IDS: A two-stage classifier ensemble for intelligent anomaly-based intrusion detection system, IEEE Access, 7 (2019), 94497–94507. https://doi.org/10.1109/ACCESS.2019.2928048 doi: 10.1109/ACCESS.2019.2928048
    [37] B. I. Seraphim, E. Poovammal, K. Ramana, N. Kryvinska, N. Penchalaiah, A hybrid network intrusion detection using darwinian particle swarm optimization and stacked autoencoder hoeffding tree, Math. Biosci. Eng., 18 (2021), 8024–8044. https://doi.org/10.3934/mbe.2021398 doi: 10.3934/mbe.2021398
    [38] S. Seo, S. Park, J. Kim, Improvement of network intrusion detection accuracy by using restricted Boltzmann machine, in 2016 8th International Conference on Computational Intelligence and Communication Networks (CICN), (2016), 413–417. https://doi.org/10.1109/CICN.2016.87
    [39] W. Li, G. Yin, X. Chen, Application of deep extreme learning machine in network intrusion detection systems, IAENG Int. J. Comput. Sci., 47 (2020), 136–143.
    [40] Z. R. Zhao, L. N. Ge, G. F. Zhang, A novel DBN-LSSVM ensemble method for intrusion detection system, in 2021 9th International Conference on Communications and Broadband Networking, (2021), 101–107. https://doi.org/10.1145/3456415.3456431
    [41] H. Zhang, L. N. Ge, Z. Wang, A high performance intrusion detection system using LightGBM based on oversampling and undersampling, in International Conference on Intelligent Computing, 13393 (2022), 638–652. https://doi.org/10.1007/978-3-031-13870-6_53
    [42] G. L. Ke, Q. Meng, T. Finley, T. F. Wang, W. Cheng, W. D. Ma, et al., Lightgbm: A highly efficient gradient boosting decision tree, Adv. Neural Inf. Process. Syst., 30 (2017).
    [43] T. Chen, C. Guestrin, Xgboost: A scalable tree boosting system, in Proceedings of the 22nd ACM Sigkdd International Conference on Knowledge Discovery and Data Mining, (2016), 785–794. https://doi.org/10.1145/2939672.2939785
    [44] K. Mo, J. Li, A deep auto-encoder based LightGBM approach for network intrusion detection system, in Proceedings of the International Conference on Advances in Computer Technology, Information Science and Communications, (2019), 142–147. http://doi.org/10.5220/0008098401420147
    [45] T. Y. Lin, P. Goyal, R. Girshick, K. He, P. Dollar, Focal loss for dense object detection, in Proceedings of the IEEE International Conference on Computer Vision, (2017), 2980–2988.
    [46] Q. Liu, D. Wang, Y. Jia, S. Luo, C. Wang, A multi-task based deep learning approach for intrusion detection, Knowl. Based Syst., 238 (2022), 1–12. https://doi.org/10.1016/j.knosys.2021.107852 doi: 10.1016/j.knosys.2021.107852
    [47] N. Shone, T. N. Ngoc, V. D. Phai, Q. Shi, A deep learning approach to network intrusion detection, IEEE Trans. Emerging Top. Comput. Intell., 2 (2018), 41–50. https://doi.org/10.1109/TETCI.2017.2772792 doi: 10.1109/TETCI.2017.2772792
    [48] S. Naseer, Y. Saleem, S. Khalid, M. K. Bashir, J. Han, M. M. Iqbal, et al., Enhanced network anomaly detection based on deep neural networks, IEEE Access, 6 (2018), 48231–48246. https://doi.org/10.1109/ACCESS.2018.2863036 doi: 10.1109/ACCESS.2018.2863036
    [49] M. Tavallaee, E. Bagheri, W. Lu, A. A. Ghorbani, A detailed analysis of the KDD CUP 99 data set, in 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, (2009), 1–6. https://doi.org/10.1109/CISDA.2009.5356528
    [50] N. Moustafa, J. Slay, UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set), in 2015 Military Communications and Information Systems Conference (MilCIS), (2015), 1–6. https://doi.org/10.1109/MilCIS.2015.7348942
    [51] N. Moustafa, J. Slay, The evaluation of network anomaly detection systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set, Inf. Secur. J. Global Perspect., 25 (2016), 18–31. http://dx.doi.org/10.1080/19393555.2015.1125974 doi: 10.1080/19393555.2015.1125974
    [52] W. J. Lian, G. Q. Nie, B. Jia, D. D. Shi, Q. Fan, Y. Q. Liang, An intrusion detection method based on decision tree-recursive feature elimination in ensemble learning, Math. Prob. Eng., 2020 (2020). https://doi.org/10.1155/2020/2835023 doi: 10.1155/2020/2835023
    [53] LightGBM. Available from: https://lightgbm.readthedocs.io/
    [54] N. Moustafa, J. Slay, G. Creech, Novel geometric area analysis technique for anomaly detection using trapezoidal area estimation on large-scale networks, IEEE Trans. Big Data, 5 (2017), 481–494. https://doi.org/10.1109/TBDATA.2017.2715166 doi: 10.1109/TBDATA.2017.2715166
    [55] B. A. Tama, K. H. Rhee, An in-depth experimental study of anomaly detection using gradient boostedmachine, Neural Comput. Appl., 31 (2019), 955–965. https://doi.org/10.1007/s00521-017-3128-z doi: 10.1007/s00521-017-3128-z
  • Reader Comments
  • © 2023 the Author(s), licensee AIMS Press. This is an open access article distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/4.0)
通讯作者: 陈斌, bchen63@163.com
  • 1. 

    沈阳化工大学材料科学与工程学院 沈阳 110142

  1. 本站搜索
  2. 百度学术搜索
  3. 万方数据库搜索
  4. CNKI搜索

Metrics

Article views(2347) PDF downloads(138) Cited by(6)

Figures and Tables

Figures(17)  /  Tables(7)

/

DownLoad:  Full-Size Img  PowerPoint
Return
Return

Catalog