Handling nominal features in anomaly intrusion detection problems

Proceedings of the IEEE International Workshop on Research Issues in Data Engineering

Volumn , Issue , 2005, Pages 55-62

  Shyu, Mei Ling ^a   Sarinnapakorn, Kanoksri ^a   Kuruppu Appuhamilage, Indika ^a   Chen, Shu Ching ^b   Chang, LiWu ^c   Goldring, Thomas ^d  

^a University of Miami College of Engineering   (United States)

^b The Department of Electrical and Computer Engineering   (United States)

^c NAVAL RESEARCH LABORATORY   (United States)

^d NATIONAL SECURITY AGENCY   (United States)

Author keywords

Anomaly detection; Indicator variables; Intrusion detection; Multiple correspondence analysis; Nominal features; Principal component classifier

Indexed keywords

ANOMALY DETECTION METHODS; DATA STREAMS; INTRUSION DETECTION; PRINCIPAL COMPONENT CLASSIFIERS (PCC);

DATA PROCESSING; METRIC SYSTEM;

COMPUTER NETWORKS;

EID: 27144530995     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (27)

1. D. Anderson, T. Lunt, H. Javitz, A. Tamaru, and A. Valdes. Detecting Unusual Program Behavior Using the Statistical Component of the Next-Generation Intrusion Detection Expert System (NIDES). Technical Report SRI-CSL-95-06, Computer Science Laboratory, SRI International, 1995.
2. D. Barbara, N. Wu, and S. Jajodia. Detecting novel network intrusions using Bayes estimator. In Proceedings of the First SIAM Int'l Conf. on Data Mining (SDM01), 2001.
3. M. C. Clark, L. O. Hall, C. Li, and D. B. Goldgof. Knowledge based (re-)clustering. In The 12th International Conference on Pattern Recognition, pages 245-250, Jerusalem, Israel, October 1994.
4. S. M. Emran and N. Ye. Robustness of Canberra metric in computer intrusion detection. In Proceedings of the 2001 IEEE Workshop on Information Assurance and Security, US Military Academy, pages 80-84, New York, 2001.
5. J. Gomez and D. Dasgupta. Evolving fuzzy classifiers for intrusion detection. In Proceedings of the 2002 IEEE Workshop on Information Assurance, New York. June 2002.
6. M. J. Greenacre. Theory and Applications of Correspondence Analysis. Academic Press, London. 1984.
7. IANA:Internet Assigned Number Authority. http://www.iana.org.
8. R. A. Johnson and D. W. Wichern. Applied Multivariate Statistical Analysis, 5th Ed. Prentice-Hall, New Jersey, 2002.
9. I. Jolliffe. Principal Component Analysis. Springer-Verlag, 2002.
10. H. G. Kayaclk. Hierarchical self organizing map based IDS on KDD benchmark. Master's thesis, Dalhousie University, 2003.
11. KDD99. KDD Cup 1999 Data. http://kdd.ics.uci.edu/databases/kddcup99/ kddcup99.html.
12. K. Labib and R. Vemuri. NSOM: A real-time network-based intrusion detection system using self-organizing maps. Networks Security, submitted, 2002.
13. W. Lee and S. Stolfo. A framework for constructing features and models for intrusion detection systems. Transactions on Information and System Security, 3(4):227-261, 2000.
14. M. Mahoney and P. K. Chan. Learning nonstationary models of normal network traffic for detecting novel attacks. In Proceedings of the 8th International Conference on Knowledge Discovery and Data Mining, pages 376-385, 2002.
15. M. Markou and S. Singh. Novelty detection: A review part 1: Statistical approaches. Signal Processing, 83(12):2481-2497, Dec. 2003.
16. M. Markou and S. Singh. Novelty detection: A review part 2: Neural network-based approaches. Signal Processing, 83(12):2499-2521, Dec. 2003.
17. J. Neter, M. H. Kutner, W. Wasserman, and C. J. Nachtschiem. Applied Linear Statistical Models, 4th Ed. McGraw-Hill/Irwin, New York, 1996.
18. V. Paxson. Bro: A system for detecting network intruders in real-time. In Proceedings of the 7th USENIX Security Symposium, 1998.
19. L. Portnoy, E.Eskin, and S. J.Stolfo. Intrusion detection with unlabeled data using clustering. In Proceedings of the ACM CSS Workshop on Data Mining Applied to Security, Philadelphia, PA, 2001.
20. J. Postel. Transmission Control Protocol - DARPA Internet Program Protocol Specification. STD 7, RFC 793, USC/Information Sciences Institute, September 1981.
21. M. Roesch. Snort - lightweight intrusion detecion for networks. In Proceedings of USENIX LISA, Nov 1999.
22. M. Sabhnani and G. Serpen. Application of machine learning algorithms to KDD intrusion detection dataset within misuse detection context. In Proceedings of the 2003 Int'l Conference on Machine Learning; Models, Technologies and Applications, pages 623-630, New York, June 2003.
23. SAS Online Doc version 8. SAS Institute Inc., 2000.
24. M.-L. Shyu, S.-C. Chen, K. Sarinnapakorn, and L. Chang. A novel anomaly detection scheme based on principal component classifier. In Proceedings of the IEEE Foundations and New Directions of Data Mining Workshop, in conjunction with the Third IEEE International Conference on Data Mining (ICDM'03), pages 172-179, Florida, Nov. 2003.
25. M.-L. Shyu, S.-C. Chen, K. Sarinnapakorn, and L. Chang. Principal Component-based Anomaly Detection Scheme. Physica-Verlag, 2004. accepted for publication.
26. S. Staniford, J. Hoagland, and J. McAlerney. Practical automated detection of stealthy portscans. Journal of Computer Security, 10(1-2): 105-136, 2002.
27. Thomson. Scale of Measurement, Statistics Workshops. http://www. wadsworth.com/, 2004. Thomson Wadsworth.