A comparative study of unsupervised machine learning and data mining techniques for intrusion detection

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 4571 LNAI, Issue , 2007, Pages 404-418

  Sadoddin, Reza ^a   Ghorbani, Ali A ^a  

^a UNIVERSITY OF NEW BRUNSWICK   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

DATA MINING; DISTRIBUTION FUNCTIONS; ENGINEERING RESEARCH; HEURISTIC ALGORITHMS; UNSUPERVISED LEARNING;

ABNORMAL DATA; DATA MINING TECHNIQUES; UNSUPERVISED MACHINE LEARNING; UNSUPERVISED TECHNIQUES;

INTRUSION DETECTION;

EID: 37249023319     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-73499-4_31     Document Type: Conference Paper

References (26)

1. Available at http://kdd.ics.uci.edU//databases/kddcup99/kddcup99.html
2. Balasko, B., Abonyi, J., Feil, B.: Fuzzy clustering and data analysis toolbox, Available at http://www.fmt.vein.hu/softcomp/fclusttoolbox
3. Bezdek, J.C.: Pattern recognition with fuzzy objective function algorithms. Kluwer Academic Publishers, Norwell, MA, USA (1981)
4. Breunig, M.M., Kriegel, H.P., Ng, R.T., Sander, J.: LOF: identifying density-based local outliers. SIGMOD Rec. 29(2), 93-104 (2000)
5. Brownlee, K.: Statistical theory and methodology. John Wiley and Sons, New York (1967)
6. Chan, P., Mahoney, M., Arshad, M.: Learning rules and clusters for anomaly detection in network traffic. Managing Cyber Threats: Issues, Approaches and Challenges, 81-99 (2003)
7. Chang, C.-C., Lin, C-J.: LIBSVM: a library for support vector machines (2001) Software available at http://www.csie.ntu.edu.tw/~cjlin/libsvm
8. Dempster, A.P., Laird, N.M., Rubin, D.B.: Maximum likelihood from incomplete data via the em algorithm. J. Royal Stat. Soc. 39, 1-38 (1977)
9. Denning, D.E.: An intrusion-detection model. IEEE Trans. Softw. Eng. 13(2), 222-232 (1987)
10. Dunn, J.C.: A fuzzy relative of the isodata process and its use in detecting compact well-separated clusters. Journal of Cybernatics 3, 32-57 (1974)
11. Eskin, E., Arnold, A., Prerau, M., Portnoy, L., Stolfo, S.: A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data. Data Mining for Security Applications (2002)
12. Guan, Y., Ghorbani, A., Belacel, N.: Y-Means: A clustering method for intrusion detection. In: Canadian Conference on Electrical and Computer Engineering, Montreal, Quebec, Canada (2003)
13. Harmeling, S., Dornhege, G., Tax, D., Meinecke, F., Muller, K.: From outliers to prototypes: Ordering data. Neurocomputing 69(13-15), 1608-1618 (2006)
14. Jin, W., Tung, A.K.H., Han, J.: Mining top-n local outliers in large databases. In: KDD '01. Proceedings of the seventh ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 293-298. ACM Press, New York (2001)
15. Kohonen, T.: Self-organizing map. Springer, Heidelberg (1997)
16. Lazarevic, A., Ertoz, L., Kumar, V., Ozgur, A., Srivastava, J.: A comparative study of anomaly detection schemes in network intrusion detection. In: Proceedings of the Third SIAM International Conference on Data Mining (2003)
17. Lei, J.Z., Ghorbani, A.: Network intrusion detection using an improved competitive learning neural network. In: CNSR, pp. 190-197 (2004)
18. MacQueen, J.: Some methods for classification and analysis of multivariate observations. In: 5th Berkley Symposium on Math and Probability, pp. 281-297 (1967)
19. Portnoy, L., Eskin, E., Stolfo, S.: Intrusion detection with unlabeled data using clustering. In: ACM Workshop on Data Mining Applied to Security (DMSA), ACM Press, New York (2001)
20. Ramadas, M., Ostermann, S., Tjaden, B.: Detecting anomalous network traffic with self-organizing maps. In: Vigna, G., Krügel, C., Jonsson, E. (eds.) RAID 2003. LNCS, vol. 2820, Springer, Heidelberg (2003)
21. Sabhnani, M., Serpen, G.: Application of machine learning algorithms to kdd intrusion detection dataset within misuse detection context. In: Proceedings of the International Conference on Machine Learning, Models, Technologies and Applications (MLMTA 2003), vol. 1, pp. 209-215 (2003)
22. Scholkopf, B., Piatt, J., Shawe-Taylor, J., Smola, A.J., Williamson, R.C.: Estimating the support of a high-dimensional distribution. Neural Computation 13(7), 1443-1472 (2001)
23. Vesanto, J., Himberg, J., Alhoniemi, E., Parhankangas, J.: Som toolbox for matlab 5, Helsinki Univ. Technology (2000), Available at http://www.cis.hut.fi/projects/somtoolbox
24. Witten, I.H., Frank, E.: Data mining: Practical machine learning tools and techniques, 2nd edn. Morgan Kaufmann, San Francisco (2005)
25. Ye, N., Emran, S.M., Chen, Q., Vilbert, S.: Multivariate statistical analysis of audit trails for host-based intrusion detection. IEEE Trans. Comput. 51(7), 810-820 (2002)
26. Zhong, S., Khoshgoftaar, T.M., Seliya, N.: Clustering-based network intrusion detection (2005)