Ensemble methods for anomaly detection and distributed intrusion detection in Mobile Ad-Hoc Networks

Information Fusion

Volumn 9, Issue 1, 2008, Pages 96-119

  Cabrera, João B D ^a   Gutiérrez, Carlos ^a   Mehra, Raman K ^a  

^a SCIENTIFIC SYSTEMS COMPANY INC   (United States)

Author keywords

Anomaly detection; Distributed detection; Ensemble methods; Intrusion detection; Mobile ad hoc networks; Multiple classifier systems

Indexed keywords

COMPUTATION THEORY; DATA ACQUISITION; HIERARCHICAL SYSTEMS; INTRUSION DETECTION; LEARNING ALGORITHMS; PROBLEM SOLVING; ROUTING PROTOCOLS;

ANOMALY DETECTIONS; DISTRIBUTED DETECTIONS; ENSEMBLE METHODS; MOBILE ADHOC NETWORKS; MULTIPLE CLASSIFIER SYSTEMS;

AD HOC NETWORKS;

EID: 35348828484     PISSN: 15662535     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.inffus.2007.03.001     Document Type: Article

References (69)

1. Ho T.K., Hull J.J., and Srihari S.N. Decision combination in multiple classifier systems. IEEE Transactions on Pattern Analysis and Machine Intelligence 16 1 (1994) 66-75 (January)
2. Xu L., Krzyzak A., and Suen C.Y. Methods of combining multiple classifiers and their applications to handwriting recognition. IEEE Transactions on Systems, Man, and Cybernetics 22 3 (1992) 418-435 (May)
3. Kuncheva L.I. Combining Pattern Classifiers: Methods and Algorithms (2004), Wiley
4. Cabrera J.B.D. On the impact of fusion strategies on classification errors for large ensembles of classifiers. Pattern Recognition 39 11 (2006) 1963-1978 (November)
5. In: Oza N.C., Polikar R., Kittler J., and Roli F. (Eds). Multiple Classifier Systems, 6th International Workshop, Seaside, CA. Lecture Notes in Computer Science vol. 3541 (2005), Springer Verlag (June)
6. Kittler J., Hatef M., Duin R.P.W., and Matas J. On combining classifiers. IEEE Transactions on Pattern Analysis and Machine Intelligence 20 3 (1998) 226-239
7. Fukunaga K. Introduction to Statistical Pattern Recognition (1990), Academic Press
8. D.M.J. Tax. One-class classification. Ph.D. thesis. Delft University of Technology, Delft, Holland, 2001 (June).
9. W. Lee, S. Stolfo, P. Chan, E. Eskin, W. Fan, M. Miller, S. Hershkop, J. Zhang, Real Time Data Mining-based Intrusion Detection, in: Proceedings of The 2001 DARPA Information Survivability Conference and Exposition (DISCEX II), Anaheim, CA, 2001 (June).
10. L. Didaci, G. Giacinto, F. Roli, Ensemble Learning for Intrusion Detection in Computer Networks, in: Proceedings of the 8th Conference of the Italian Association of Artificial Intelligence (AIAA), Siena, Italy, 2002 (September).
11. Chebrolu S., Abraham A., and Thomas J.P. Feature deduction and ensemble design of intrusion detection systems. Computers and Security 24 4 (2005) 295-307 (June)
12. Y. Zhang, W. Lee, Intrusion Detection in Wireless Ad-Hoc Networks, in: Proceedings of the 6th International Conference on Mobile Computing and Networking, 2000 (August).
13. Zhang Y., Lee W., and Huang Y.-A. Intrusion detection techniques for mobile wireless networks. Wireless Networks 9 5 (2003) 545-556 (September)
14. Y.-A. Huang, W. Lee, A Cooperative intrusion detection system for ad hoc networks, in: ACM Workshop on Security of Ad Hoc and Sensor Network (SASN'03), Fairfax, VA, 2003 (October).
15. Akyildiz I.F., Su W., Sankarasubraniam Y., and Cayirci E. Wireless sensor networks: a survey. Computer Networks 38 (2002) 393-422
16. Perkins C.E. Ad-Hoc Networking (2000), Addison Wesley Professional
17. J. Voorhees, The Limits on Wireless Security: 802.11 in early 2002, SANS Institute, January 30, 2002; available at http://rr.sans.org/wireless/limits.php.
18. Zhou L., and Haas Z.J. Securing ad hoc networks. IEEE Network November (1999) 24-30
19. Cabrera J.B.D., Ravichandran B., and Mehra R.K. Statistical traffic modeling for network intrusion detection. Proceedings of the Eighth International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunications Systems (2000), IEEE Computer Society, San Francisco, CA 466-473 (August)
20. Marchette D.J. Computer Intrusion Detection and Network Monitoring - A Statistical Viewpoint (2001), Springer Verlag
21. H.S. Javitz, A. Valdes, SRI IDES Statistical Anomaly Detector, in: Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, 1991.
22. In: Schneider F.B. (Ed). Trust in Cyberspace (1998), National Academy Press
23. Chen W., Jain N., and Singh S. ANMP: Ad hoc network management protocol. IEEE Journal on Selected Areas in Communications 17 8 (1999) 1506-1531
24. Markou M., and Singh S. Novelty detection: A review. Part I: Statistical approaches; Part II: Neural network based approaches. Signal Processing 83 12 (2003) 2481-2521 (December)
25. Moya M., Koch M., and Hostetler L. One-class classifier networks for target recognition applications. Proceedings of the World Congress on Neural Networks (1993), International Neural Network Society, Portland, OR 797-801
26. Ritter G., and Gallegos M. Outliers in statistical pattern recognition and an application to automatic chromosome classification. Pattern Recognition Letters 18 (1997) 525-539
27. N. Japkowicz, Concept-Learning in the absence of counterexamples: an autoassociation-based approach to classification, Ph.D. thesis. Rutgers, The State University of New Jersey, New Brunswick, NJ, 1999.
28. Tax D.M.J., van Breukelen M., Duin R.P.W., and Kittler J. Combining multiple classifiers by averaging or multiplying?. Pattern Recognition 33 9 (2000) 1475-1485 (September)
29. M Bishop C. Novelty detection and neural network validation. IEE Proceedings - Vision, Image and Signal Processing 141 4 (1994) 217-222 (August)
30. Y.-A. Huang, W. Fan, W. Lee, P.S. Yu, Cross-Feature Analysis for Detecting Ad-Hoc Routing Anomalies, in: Proceedings of the 23th International Conference on Distributed Computing Systems, Providence, RI, 2003 (May).
31. Tumer K., and Ghosh J. Linear and Order Statistics Combiners for Pattern Classification. In: Sharkey A. (Ed). Combining Artificial Neural Networks (1999), Springer Verlag 127-162
32. Chen D., and Cheng X. An asymptotic analysis of some expert fusion methods. Pattern Recognition Letters 22 (2001) 901-904
33. Kuncheva L.I. A theoretical study on six classifier fusion strategies. IEEE Transactions on Pattern Analysis and Machine Intelligence 24 2 (2002) 281-286 (February)
34. Kittler J., and Alkoot F.M. Sum versus vote fusion in multiple classifier systems. IEEE Transactions on Pattern Analysis and Machine Intelligence 25 1 (2003) 110-115 (January)
35. Tax D.M.J., Duin R.P.W., and van Breukelen M. Comparison between product and mean classifier combination rules. In: Pudil P., Novovicova J., and Grim J. (Eds). First International Workshop on Statistical Techniques in Pattern Recognition (1997), Institute of Information Theory and Automation 165-170 (June)
36. L. Breiman, Probability, Society for Industrial and Applied Mathematics, Philadelphia, PA, 1992. Unabridged, corrected republication of the work first published by Addison-Wesley Publishing Company, Inc., Reading, MA, 1968.
37. Breiman L. Probability and Stochastic Processes With a View Toward Applications (1969), Houghton Mifflin Company, Boston
38. R.P. Lippmann, D. Fried, I. Graf, J.W. Haines, K.R. Kendall, D. McClung, D. Weber, S.E. Webster, D. Wyschogrod, R.K. Cunningham, M. Zissmann, Evaluating Intrusion Detection Systems: The 1998 DARPA Off-Line Intrusion Detection Evaluation, in: Proceedings of the 2000 DARPA Information Survivability Conference and Exposition, vol. 2, 2000.
39. W. Fan, W. Lee, S.J. Stolfo, M. Miller, A multiple-model cost-sensitive approach for intrusion detection, in: Proceedings of the Eleventh European Conference on Machine Learning, 2000.
40. W. Fan, Cost-sensitive, Scalable and Adaptive Learning Using Ensemble-based Methods, Ph.D. thesis. Columbia University, New York, NY, February 2001.
41. Giacinto G., Roli F., and Didaci L. Fusion of multiple classifiers for intrusion detection in computer networks. Pattern Recognition Letters 24 12 (2003) 1795-1803
42. A.H. Sung, S. Mukkamala, Identifying important features for intrusion detection using support vector machines and neural networks, in: Proceedings of International Symposium on Applications and the Internet (SAINT 2003), 2003.
43. Tax D.M.J., and Duin R.P.W. Combining One-Class Classifiers. In: Kittler J., and Roli F. (Eds). Multiple Classifier Systems, 2nd International Workshop. Lecture Notes in Computer Science vol. 2096 (2001), Springer Verlag, Cambridge, UK 299-308 (July)
44. Bradley A.P. The use of the area under the ROC curve in the evaluation of machine learning algorithms. Pattern Recognition 30 7 (1997) 1145-1159
45. Lai C., Tax D.M.J., Duin R.P.W., Pekalska E., and Paclik P. On Combining One-Class Classifiers for Image Database Retrieval. In: Roli F., and Kittler J. (Eds). Multiple Classifier Systems, 3rd International Workshop. Lecture Notes in Computer Science vol. 2364 (2002), Springer Verlag, Cagliari, Italy 212-221 (June)
46. Juszczak P., and Duin R.P.W. Combining One-Class Classifiers to Classify Missing Data. In: Roli F., Kittler J., and Windeatt T. (Eds). Multiple Classifier Systems, 5th International Workshop. Lecture Notes in Computer Science vol. 3077 (2004), Springer Verlag, Cagliari, Italy 92-101 (June)
47. Rätsch G., Mika S., Schölkopf B., and Müller K.-R. Constructing boosting algorithms from SVMs: An application to one-class classification. IEEE Transactions on Pattern Analysis and Machine Intelligence 24 9 (2002) 1184-1199 (September)
48. H.-H. Tong, C.-R. Li, J.-R. He, Q.-A. Tran, H.-X. Duan, X. Li, A Novel Boosting-Based Anomaly Detection Scheme, in: Proceedings of the Fourth International Conference on Machine Learning and Cybernetics, Guangzhou, China, August 2005.
49. A. Lazarevic, V. Kumar, Feature Bagging for Outlier Detection, in: Proceedings of the Eleventh International Conference on Knowledge Discovery and Data Mining (KDD'2005), Chicago, IL, 2005 (August).
50. J.B.D. Cabrera, L. Lewis, R.K. Mehra, Detection and Classification of Intrusions and Faults using Sequences of System Calls, ACM SIGMOD Record Special Issue on Data Mining for Intrusion Detection, Security and Threat Analysis 30(4) (2001) 25-34 (December).
51. Giacinto G., Perdisci R., and Roli F. Network Intrusion Detection by combining One-class Classifiers. In: Roli F., and Vitulano S. (Eds). Proceedings of the 13th International Conference on Image Analysis and Processing (ICIAP 2005). Lecture Notes in Computer Science vol. 3617 (2005), Springer Verlag, Cagliari, Italy (September)
52. J.B.D. Cabrera, C. Gutiérrez, R.K. Mehra, Infrastructures and Algorithms for Distributed Anomaly-Based Intrusion Detection in Mobile Ad-Hoc Networks, in: Proceedings of the IEEE Military Communications Conference (IEEE MILCOM 2005), Atlantic City, NJ, October 2005.
53. Breiman L., Friedman J.H., Olshen R.A., and Stone C.J. Classification and Regression Trees (1984), Chapman and Hall, New York
54. Quinlan J.R. C4.5: Programs for Machine Learning (1994), Morgan Kaufmann
55. Z.-S. Pang, S.C. Chen, G.B. Hu, D.Q. Zhang, Hybrid neural network and C4.5 for misuse detection, in: Proceedings of the 2003 IEEE International Conference on Machine Learning and Cybernetics, 2003, pp. 2463-2467 (November).
56. D.K. Kang, D. Fuller, V. Honavar, Learning Classifiers for Misuse and Anomaly Detection Using a Bag of System Calls Representation, in: Proceedings of the 6th IEEE Information Assurance Workshop, West Point, NY, 2005, pp. 118-125 (June).
57. W. Cohen, Fast effective rule induction, in: Proceedings of the Twelfth International Conference on Machine Learning, 1995.
58. C. Borgelt, A Naive Bayes Classifier Plug-In for DataEngine, in: Proceedings of the Third Data Analysis Symposium, Aachen, Germany, 1999, pp. 87-90.
59. S. McCanne and S. Floyd. The Network Simulator - ns-2; available at: http://www.isi.edu/nsnam/ns.
60. C.E. Perkins and E.M. Royer, Ad hoc On Demand Distance Vector Routing, in: Proceedings of the 2nd IEEE Workshop on Mobile Computing Systems and Applications, New Orleans, LA, February 1999, pp. 90-100.
61. P. Jacquet, P. Muhlethaler, A. Qayyum, Optimized Link-State Routing Protocol (draft-ietf-manet-olsr-00.txt), Technical report, MANET IETF drafts, November 1998, available at http://www.ietf.org/proceedings/99mar/I-D/draft-ietf-manet-olsr-00.txt.
62. P. Ning, K. Sun, How to Misuse AODV: A Case Study of Insider Attacks against Mobile Ad-hoc Routing Protocols, in: Information Assurance Workshop, 2003, IEEE Systems, Man and Cybernetics Society, West Point, New York, 2003.
63. D. Dhillon, T.S. Randhawa, M. Wang, L. Lamont, Implementing a Fully Distributed Certificate Authority in an OLSR MANET, available at: http://www.crc.ca/fr/html/manetsensor/home/publications/WCNC2004.pdf.
64. Camp T., Boleng J., and Davies V. A survey of mobility models for ad hoc network research. Wireless Communications and Mobile Computing (WCMC): Special issue on Mobile Ad Hoc Networking: Research, Trends and Applications 2 5 (2002) 483-502
65. Mobile Ad Hoc Networks for the Military, Cisco Systems, Inc., White Paper GDSG-APAC-MANET ver 3.0, 2003.
66. Fumera G., and Roli F. A theoretical and experimental analysis of linear combiners for multiple classifier systems. IEEE Transactions on Pattern Analysis and Machine Intelligence 27 6 (2005) 942-956 (June)
67. Tumer K., and Ghosh J. Error correlation and error reduction in ensemble classifiers. Connection Science 8 3/4 (1996) 385-404
68. Casella G., and Berger R.L. Statistical Inference (1990), Duxbury Press, Belmont, CA
69. Billingsley P. Convergence of Probability Measures (1968), John Wiley and Sons