Analytical Validation and Integration of CIC-Bell-DNS-EXF-2021 Dataset on Security Information and Event Management

Simple item page
dc.contributor.authorGyana Ranjana Panigrahi
dc.contributor.authorPrabira Kumar Sethy
dc.contributor.authorSanti Kumari Behera
dc.contributor.authorManoj Gupta
dc.contributor.authorFarhan A. Alenizi
dc.contributor.authorPannee Suanpang
dc.contributor.authorAziz Nanthaamornphong
dc.contributor.correspondenceP.K. Sethy; Sambalpur University, Department of Electronics, Sambalpur, Odisha, 768019, India; email: prabirsethy.05@gmail.com; A. Nanthaamornphong; Prince of Songkla University, College of Computing, Phuket, 83120, Thailand; email: aziz.n@phuket.psu.ac.th
dc.date.accessioned2025-03-10T07:34:21Z
dc.date.available2025-03-10T07:34:21Z
dc.date.issued2024
dc.description.abstractContemporary culture presents a substantial obstacle for cyber security experts in the shape of software vulnerabilities, which, if taken advantage of, can jeopardize the Confidentiality, Integrity, and Availability (CIA) of any system. Data-driven and modern threat intelligence tools can enhance cyber security, bolster resilience, and foster innovation across cloud, multi-cloud, and hybrid platforms. As a result, performance evaluation and accuracy verification have become essential for Security Information and Event Management (SIEM) to prevent cyber threats. The SIEM system offers threat intelligence, reporting, and security incident management through the collection and analysis of event logs and other data sources that are specific to events and their context. We propose a hybrid strategy to address threat intelligence, reporting, and security incident management consisting of two layers that utilize a predefined set of characteristics. Here, we use RStudio to assess how well a hybrid intrusion detection system (HIDS) handles the CIC-Bell-DNS-EXF-2021 dataset. Furthermore, we have incorporated our developed model into Multi-Criteria Decision Analysis Methods (MCDM) to enhance the methods' ability to identify complex DNS exfiltration attacks using machine learning algorithms: RF-AHP (RA), KNN-TOPSIS (KT), GBT-VIKOR (GV), and DT-Entropy-TOPSIS (DET). We consider several factors during the work, including accuracy, absolute error, weighted average recall, weighted average precision, kappa value, logistic loss, and root mean square deviation (RMSD). We use the Machine-Automated Model function to integrate and validate the models. According to the findings, GV has the highest level of accuracy, with a rate of 99.52%, while KT has the lowest level of authenticity, with a rate of 93.65%. Furthermore, these findings illustrate enhanced performance metrics for multiclass classification in comparison to previous approaches. © 2013 IEEE.
dc.identifier.citationIEEE Access
dc.identifier.doi10.1109/ACCESS.2024.3409413
dc.identifier.issn21693536
dc.identifier.scopus2-s2.0-85195396010
dc.identifier.urihttps://repository.dusit.ac.th//handle/123456789/4507
dc.languageEnglish
dc.publisherInstitute of Electrical and Electronics Engineers Inc.
dc.rightsAll Open Access; Gold Open Access
dc.rights.holderScopus
dc.subjectanalytical validation
dc.subjectCIC-Bell-DNS-EXF-2021
dc.subjectCyber security
dc.subjectHIDS
dc.subjectmachine learning
dc.subjectMCDM
dc.subjectperformance assessment
dc.subjectSIEM
dc.titleAnalytical Validation and Integration of CIC-Bell-DNS-EXF-2021 Dataset on Security Information and Event Management
dc.typeArticle
mods.location.urlhttps://www.scopus.com/inward/record.uri?eid=2-s2.0-85195396010&doi=10.1109%2fACCESS.2024.3409413&partnerID=40&md5=0d8de04e5c6cdcd35c490fae74a292a9
oaire.citation.endPage83056
oaire.citation.startPage83043
oaire.citation.volume12
Files
Collections
SCOPUS 2024