Data Mining for Intrusion Detection: From Outliers to True Intrusions
Lecture notes in computer sciencePublished 1 January 2009Open access
Goverdhan Singh, Florent Masséglia, Céline Fiot, Alice Marascu, Pascal Poncelet
Citations18
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This paper considers to add a new feature to such isolated behaviours before they can be considered as malicious, based on their possible repetition from one information system to another.
Abstract
Abstract. Data mining for intrusion detection can be divided into several sub-topics, among which unsupervised clustering has controversial properties. Unsupervised clustering for intrusion detection aims to i) group behaviors together depending on their similarity and ii) detect groups containing only one (or very few) behaviour. Such isolated behaviours are then considered as deviating from a model of normal-ity and are therefore considered as malicious. Obviously, all atypical behaviours are not attacks or intrusion attempts. Hence, this is the limits of unsupervised clustering for intrusion detection. In this paper, we consider to add a new feature to such iso-lated behaviours before they can be considered as malicious. This feature is based on their possible repetition from one information system to another. We propose a new outlier mining principle and validate it through a set of experiments. 1
Keywords
Computer ScienceEngineering
Computers in PhysicsTen Lectures on Wavelets
15,386 Citations1992Ingrid Daubechies, Christopher Heil
This paper presents a meta-analyses of the wavelet transforms of Coxeter’s inequality and its applications to multiresolutional analysis and orthonormal bases.
Algorithms for Mining Distance-Based Outliers in Large Datasets
1,530 Citations1998Edwin M. Knorr, Raymond T. Ng
This paper provides formal and empirical evidence showing the usefulness of DB-outliers and presents two simple algorithms for computing such outliers, both having a complexity of O(k N’), k being the dimensionality and N being the number of objects in the dataset.
Computer NetworksAn overview of anomaly detection techniques: Existing solutions and latest technological trends
1,522 Citations2007Animesh Patcha, Jung‐Min Park
This paper provides a comprehensive survey of anomaly detection systems and hybrid intrusion detection systems of the recent past and present and discusses recent technological trends in anomaly detection and identifies open problems and challenges in this area.
Signal ProcessingNovelty detection: a review—part 1: statistical approaches
1,414 Citations2003M. Markou, Sameer Singh
There are a multitude of applications where novelty detection is extremely important including signal processing, computer vision, pattern recognition, data mining, and robotics.
Data Mining Approaches for Intrusion Detection
1,191 Citations2000Wenke Lee, Salvatore J. Stolfo
An agent-based architecture for intrusion detection systems where the learning agents continuously compute and provide the updated (detection) models to the detection agents is proposed.
A Comparative Study of Anomaly Detection Schemes in Network Intrusion Detection
862 Citations2003Aleksandar Lazarević, Levent Ertöz +3 more
The experimental results indicate that some anomaly detection schemes appear very promising when detecting novel intrusions in both DARPA’98 data and real network data.
LOCI: fast outlier detection using the local correlation integral
848 Citations2004Spiros Papadimitriou, Hiroyuki Kitagawa +2 more
Experiments show that LOCI and aLOCI can automatically detect outliers and micro-clusters, without user-required cut-offs, and that they quickly spot both expected and unexpected outliers.
Columbia Academic Commons (Columbia University)Intrusion detection with unlabeled data using clustering
756 Citations2000Leonid Portnoy
Advances in information securityA Geometric Framework for Unsupervised Anomaly Detection
662 Citations2002Eleazar Eskin, Andrew O. Arnold +3 more
A new geometric framework for unsupervised anomaly detection is presented, which are algorithms that are designed to process unlabeled data to detect anomalies in sparse regions of the feature space.
Lecture notes in computer scienceProbabilistic Alert Correlation
629 Citations2001Alfonso Valdes, Keith Skinner
The probabilistic approach provides a unified mathematical framework for correlating alerts that match closely but not perfectly, where the minimum degree of match required to fuse alerts is controlled by a single configurable parameter.
Information-theoretic measures for anomaly detection
540 Citations2002Wenke Lee, Dong Xiang
This work proposes to use several information-theoretic measures, namely, entropy, conditional entropy, relative conditional entropy; information gain, information gain; and information cost for anomaly detection for protection mechanisms against novel attacks.
Computational Statistics & Data AnalysisBACON: blocked adaptive computationally efficient outlier nominators
540 Citations2000Nedret Billor, Ali S. Hadi +1 more
CARDWATCH: a neural network based database mining system for credit card fraud detection
392 Citations2002E. Aleskerov, Bernd Freisleben +1 more
CardWATCH, a database mining system used for credit card fraud detection, is presented and test results obtained for synthetically generated credit card data and an autoassociate neural network model show very successful fraud detection rates.
Choice Reviews OnlineWavelet theory and its applications
298 Citations1993
Wavelet Theory Extentions and Ambiguity Functions, Linear Systems Modelling with Wavelet Theory, and Practical Resolution, Gain, and Processing Structures.
Detecting Novel Network Intrusions Using Bayes Estimators
292 Citations2001Daniel Barbará, Ningning Wu +1 more
This work has been funded by AFRL Rome Labs under the contract F 30602-00-2-0512 and aims to detect well-known attacks as well as slight variations of them, by characterizing the rules that govern these attacks.
Minds at UW (University of Wisconsin)Global Intrusion Detection in the DOMINO Overlay System.
289 Citations2004Vinod Yegneswaran, Paul Barford +1 more
An architecture for a distributed intrusion detection system that fosters collaboration among heterogeneous nodes organized as an overlay network that facilitates efficient detection of attacks from spoofed IP sources, reduces false positives, and enables attack classification and production of timely blacklists is described.
Advances in information securityApplications of Data Mining in Computer Security
271 Citations2002Daniel Barbará, Sushil Jajodia
Modern Intrusion Detection, Data Mining, and Degrees of Attack Guilt, and Degrees of Attack Guilt are discussed.
An approach to spacecraft anomaly detection problem using kernel feature space
215 Citations2005Ryohei Fujimaki, Takehisa Yairi +1 more
A novel "knowledge-free" anomaly detection method for spacecraft based on Kernel Feature Space and directional distribution is proposed, which constructs a system behavior model from the past normal telemetry data from a set oftelemetry data in normal operation and monitors the current system status by checking incoming data with the model.
International Journal of Reliability Quality and Safety EngineeringCLUSTERING-BASED NETWORK INTRUSION DETECTION
118 Citations2007Shi Zhong, Taghi M. Khoshgoftaar +1 more
This work investigates multiple centroid-based unsupervised clustering algorithms for intrusion detection, and proposes a simple yet effective self-labeling heuristic for detecting attack and normal clusters of network traffic audit data.
Data mining for network intrusion detection : How to get started
111 Citations2001Eric Bloedorn
Based upon the experiences in getting started on this type of project, data mining techniques to consider and types of expertise and infrastructure needed are suggested.
Lecture notes in computer scienceAdaptive Clustering for Network Intrusion Detection
50 Citations2004Joshua Oldmeadow, Siddarth Ravinutala +1 more
A time-varying modification of a standard clustering technique is developed, which means it can automatically accommodate non-stationary traffic distributions, and how feature weighting can improve the classification accuracy of the anomaly detection system for certain types of attacks is demonstrated.
Unsupervised Anomaly Detection in Network Traffic by Means of Robust PCA
32 Citations2007Roland Kwitt, Ulrich Hofmann
The problem of contaminated training data is discussed and it is proposed to use PCA on the basis of robust estimators to overcome the necessity of a supervised preprocessing step.
Factor analysis based anomaly detection
29 Citations2004Ningning Wu, Jian Zhang
This work presents a factor analysis-based network anomaly detection algorithm and applies it to DARPA intrusion detection evaluation data and results show that the proposed algorithm is able to detect network intrusions with relatively low false alarms.
Lecture notes in computer scienceA Multi-resolution Approach for Atypical Behaviour Mining
3 Citations2009Alice Marascu, Florent Masséglia
Mrab is proposed, a self-adjusting approach intending to automatically discover atypical behaviours (in the results of a clustering algorithm) without any parameter, which is tested through a set of experiments.