Unsupervised learning techniques for an intrusion detection system

Proceedings of the ACM Symposium on Applied Computing

Volumn 1, Issue , 2004, Pages 412-419

  Zanero, Stefano ^a   Savaresi, Sergio M ^a  

^a POLITECNICO DI MILANO   (Italy)

Author keywords

Anomaly detection; Intrusion detection; K means; Principal direction divisive partitioning; Quality of clusters; Self organizing maps; Unsupervised clustering

Indexed keywords

ALGORITHMS; COMPUTER NETWORKS; DATA MINING; PATTERN MATCHING; PROBLEM SOLVING; SECURITY OF DATA; SELF ORGANIZING MAPS;

ANOMALY DETECTION; INTRUSION DETECTION; K-MEANS; PRINCIPAL DIRECTION DIVISIVE PARTITIONING; QUALITY OF CLUSTERS; UNSUPERVISED CLUSTERING;

LEARNING SYSTEMS;

EID: 2442526701     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/967900.967988     Document Type: Conference Paper

References (33)

1. J. P. Anderson. Computer security threat monitoring and surveillance. Technical report, J. P. Anderson Co., Ft. Washington, Pennsylvania, Apr 1980.
2. T. Bass. Intrusion detection systems and multisensor data fusion. Comm. of the ACM, 43(4):99-105, 2000.
3. D. Boley, V. Borst, and M. Gini. An unsupervised clustering tool for unstructured data. In IJCAI 99 Int'l Joint Conf. on Artificial Intelligence, Stockholm, Aug 1999.
4. T. F. Cox and M. A. A. Cox. Multidimensional Scaling. Monographs on Statistics and Applied Probability. Chapman & Hall, 1995.
5. S. C. Deerwester, S. T. Dumais, T. K. Landauer, G. W. Furnas, and R. A. Harshman. Indexing by latent semantic analysis. Journal of the American Society of Information Science, 41(6):391-407, 1990.
6. J. Frank. Artificial intelligence and intrusion detection: Current and future directions. In Proc. of the 17th Nat'l Computer Security Conf., Baltimore, MD, 1994.
7. L. Girardin. An eye on network intruder-administrator shootouts. In Proc. of the Workshop on Intrusion Detection and Network Monitoring, pages 19-28, Berkeley, CA, USA, 1999. USENIX Association.
8. I. Guyon and A. Elisseeff. An introduction to variable and feature selection. Journal of Machine Learning Research, 3:1157-1182, 2003.
9. J. Han and M. Kamber. Data Mining: concepts and techniques. Morgan-Kauffman, 2000.
10. J. A. Hartigan. Clustering Algorithms. Wiley, 1975.
11. D. Hawkins. Identification of Outliers. Chapman and Hall, London, 1980.
12. A. K. Jain, M. N. Murty, and P. J. Flynn. Data clustering: A review. ACM Computing Surv., 31(3):264-323, 1999.
13. I. T. Jolliffe. Principal Component Analysis. Springer Verlag, 1986.
14. K. Kendall. A database of computer attacks for the evaluation of intrusion detection systems. Master's thesis, Massachussets Institute of Technology, 1998.
15. T. Kohonen. Self-Organizing Maps. Springer-Verlag, Berling, 3 edition, 2001.
16. K. Labib and R. Vemuri. NSOM: A real-time network-based intrusion detection system using self-organizing maps. Technical report, Dept. of Applied Science, University of California, Davis, 2002.
17. T. Lane and C. Brodley. Temporal sequence learning and data reduction for anomaly detection. ACM Trans. on Information and System Security, 2(3):295-331, 1999.
18. R. Larsen. Lanczos bidiagonalization with partial reorthogonalization, PhD thesis, Dept. Computer Science, University of Aarhus, DK-8000 Aarhus C, Denmark, Oct 1998.
19. W. Lee and S. Stolfo. Data mining approaches for intrusion detection. In Proc. of the 7th USENIX Security Symp., San Antonio, TX, 1998.
20. W. Lee, S. Stolfo, and K. Mok. Mining in a data-flow environment: Experience in network intrusion detection. In S. Chaudhuri and D. Madigan, editors, Proc. of the 5th Int'l Conf. on Knowledge Discovery and Data Mining, pages 114-124, 1999.
21. E. A. Levy. Smashing the stack for fun and profit. Phrack magazine, 7(49), Nov 1996.
22. P. Lichodzijewski, A. Zincir-Heywood, and M. Heywood. Dynamic intrusion detection using self organizing maps. In 14th Annual Canadian Information Technology Security Symp., May 2002.
23. A. Likas, N. Vlassis, and J. J. Verbeek. The global k-means clustering algorithm. Pattern Recognition, 36(2), 2003.
24. M. Mahoney and P. Chan. Detecting novel attacks by identifying anomalous network packet headers. Technical Report CS-2001-2, Florida Institute of Technology, 2001.
25. J. McHugh. Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by lincoln laboratory. ACM Trans. on Information and System Security, 3(4):262-294, 2000.
26. P. A. Porras and P. G. Neumann. EMERALD: Event monitoring enabling responses to anomalous live disturbances. In Proc. 20th NIST-NCSC Nat'l Information Systems Security Conf., pages 353-365, 1997.
27. T. H. Ptacek and T. N. Newsham. Insertion, evasion, and denial of service: Eluding network intrusion detection, Technical Report T2R-0Y6, Secure Networks, Calgary, Canada, 1998.
28. S. Savaresi and D. L. Boley. On the performance of bisecting k-means and PDDP. In Proc. of the 1st SIAM Conf. on Data Mining, pages 1-14, 2001.
29. S. Savaresi, D. L. Boley, S. Bittanti, and G. Gazzaniga. Cluster selection in divisive clustering algorithms. In Proc. of the 2nd SIAM Int'l Conf. on Data Mining, pages 299-314, 2002.
30. G. Serazzi and S. Zanero. Computer virus propagation models. In M. C. Calzarossa and E. Gelenbe, editors, Tutorials of the 11th IEEE/ACM Int'l Symp. on Modeling, Analysis and Simulation of Computer and Telecom. Systems - MASCOTS 2003. Springer-Verlag, 2003.
31. K. Tan and B. Collie. Detection and classification of TCP/IP network services. In Proc. of the Computer Security Applications Conf., pages 99-107, 1997.
32. K. Yamanishi, J. ichi Takeuchi, G. J. Williams, and P. Milne. On-line unsupervised outlier detection using finite mixtures with discounting learning algorithms. In Proc. of the 6th ACM SIGKDD Int'l Conf. on Knowledge Discovery and Data Mining, pages 320-324, Aug 2000.
33. D.-Y. Yeung and C. Chow. Parzen-window network intrusion detectors. In Proc. of the 16th Int'l Conf. on Pattern Recognition, volume 4, pages 385-388, aug 2002.