Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 1811.08954

Fuzzy Rule Interpolation and SNMP-MIB for Emerging Network Abnormality

Mohammad Almseidin·Mouhammd Alkasassbeh·Szilveszter Kovacs
View original source ↗Read source document ↗Export metadata ↓

Abstract

It is difficult to implement an efficient detection approach for Intrusion Detection Systems (IDS) and many factors contribute to this challenge. One such challenge concerns establishing adequate boundaries and finding a proper data source. Typical IDS detection approaches deal with raw traffics. These traffics need to be studied in depth and thoroughly investigated in order to extract the required knowledge base. Another challenge involves implementing the binary decision. This is because there are no reasonable limits between normal and attack traffics patterns. In this paper, we introduce a novel idea capable of supporting the proper data source while avoiding the issues associated with the binary decision. This paper aims to introduce a detection approach for defining abnormality by using the Fuzzy Rule Interpolation (FRI) with Simple Network Management Protocol (SNMP) Management Information Base (MIB) parameters. The strength of the proposed detection approach is based on adapting the SNMP-MIB parameters with the FRI. This proposed method eliminates the raw traffic processing component which is time consuming and requires extensive computational measures. It also eliminates the need for a complete fuzzy rule based intrusion definition. The proposed approach was tested and evaluated using an open source SNMP-MIB dataset and obtained a 93% detection rate. Additionally, when compared to other literature in which the same test-bed environment was employed along with the same number of parameters, the proposed detection approach outperformed the support vector machine and neural network. Therefore, combining the SNMP-MIB parameters with the FRI based reasoning could be beneficial for detecting intrusions, even in the case if the fuzzy rule based intrusion definition is incomplete (not fully defined).

Explore related subjects

cs.NIcs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Mohammad Almseidin, Mouhammd Alkasassbeh, Szilveszter Kovacs. 2018-11-21. Fuzzy Rule Interpolation and SNMP-MIB for Emerging Network Abnormality. https://arxiv.org/abs/1811.08954

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Formal Abstractions for Packet Scheduling

Early programming models for software-defined networking (SDN) focused on basic features for controlling network-wide forwarding paths, but more recent work has considered richer features, such as packet scheduling and queueing, that affect performance. In particular, PIFO trees, proposed by Sivaraman et al., offer a flexible and efficient primitive for programmable packet scheduling. Prior work has shown that PIFO trees can express a wide range of practical algorithms including strict priority, weighted fair queueing, and hierarchical schemes. However, the semantic properties of PIFO trees are not well understood. This paper studies PIFO trees from a programming language perspective. We formalize the syntax and semantics of PIFO trees in an operational model that decouples the scheduling policy running on a tree from the topology of the tree. Building on this formalization, we develop compilation algorithms that allow the behavior of a PIFO tree written against one topology to be realized using a tree with a different topology. Such a compiler could be used to optimize an implementation of PIFO trees, or realize a logical PIFO tree on a target with a fixed topology baked into the hardware. To support experimentation, we develop a software simulator for PIFO trees, and we present case studies illustrating its behavior on standard and custom algorithms.

cs.NI↗
arXiv2026

Decoding Delay Guarantees of Space Regulated Multiple Access Random Wireless Networks using Successive Interference Cancellation

This paper is focused on decoding delay guarantees in wireless networks, where messages have a given signal-to-interference-plus-noise ratio threshold $η_0$ to meet in order to be successfully decoded, and where transmissions should occur within some strict time constraints. Its main contribution consists in quantifying the worst-case transmissions decoding delays in the uplink of cellular and cell-free networks using successive interference cancellation. We show how such decoding delay guarantees can be obtained using spatial network calculus, a new tool introduced recently, and in particular spatial regulation. The results rely on the assumption of absence of fading. We nevertheless outline what this approach will lead to in the fading case for cellular networks.

cs.NI↗
arXiv2026

Toward Composable Network Digital Twins: A Subgraph-Based Latency Prediction Study

Modern networks must support changing topologies, configurations, and performance objectives, motivating fast and reliable performance estimation. Network digital twins (NDTs) enable what-if analysis for performance estimation in such network scenarios, however, existing machine learning-based NDT approaches often rely on entire topology representations, which are inherently monolithic and lack reusability under topological or traffic changes in the network. This paper introduces a composable NDT approach that decomposes networks into subgraphs represented by reusable unit twins that capture subgraph structure, configuration and traffic behaviours. A lightweight composer aggregates unit twin combinations to create NDTs that predict per-route end-to-end latency through an overall topology. Evaluation across controlled synthetic topologies and diverse traffic scenarios, real-world Topology Zoo topologies, and a public NDT challenge dataset demonstrates that the composable NDTs achieve high in-distribution accuracy while remaining stable under out-of-distribution scenarios. Comparison with monolithic full topology NDTs demonstrates that our composable approach achieves reusability, while achieving comparable or superior accuracy.

cs.NI↗