Improvement in minority attack detection with skewness in network traffic

Proceedings of SPIE - The International Society for Optical Engineering

Volumn 6973, Issue , 2008, Pages

  Thomas, Ciza ^a   Balakrishnan, N ^a  

^a INDIAN INSTITUTE OF SCIENCE   (India)

Author keywords

Anomaly based IDS; Data Dependent Fusion (DD Fusion); Detection performance; F score; False Negative (FN); False Positive (FP); Intrusion Detection Systems (IDS); Neural network; Precision; Recall; Sensor fusion

Indexed keywords

DATA FUSION; NETWORK SECURITY; NEURAL NETWORKS; PRECISION ENGINEERING; TELECOMMUNICATION TRAFFIC;

DATA-DEPENDENT FUSION (DD FUSION); DETECTION PERFORMANCE; FALSE NEGATIVE (FN); FALSE POSITIVE (FP); SENSOR FUSION;

INTRUSION DETECTION;

EID: 43249098440     PISSN: 0277786X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1117/12.785623     Document Type: Conference Paper

References (38)

1. L. Breiman, J. H. Friedman, R. A. Olshen, C. J. Stone, Classification and regression trees, Belmount, CA: Wadsworth, 1984
2. M. Kubat, R. C. Holte, S. Matwin, Learning when negative examples abound: One-sided selection, Proceedings of the ninth European Conference on machine learning, pp. 146-153, 1997
3. N. V. Chawla, K. W. Bowyer, L. O. Hall, W. P. Kegelmeyer, Smote: Synthetic minority over-sampling technique, Journal of Artificial Intelligence research, vol.16, pp. 321-357, 2002
4. K. McCarthy, B. Zabar, G. Weiss, Does cost-sensitive learning beat sampling for classifying rare classes?, Proceedings of the 1st International workshop on utility-based data mining, pp. 69-77, 2005
5. P. K. Chan, S. J. Stolfo, Toward scalable learning with non-uniform class and cost distributions: A case study in credit card fraud detection, KDD 1998, pp. 164-168, 1998
6. M. V. Joshi, R. C. Agarwal, V. Kumar, Mining needles in a haystack: classifying rare classes via two-phase rule induction, ACM SIGMOD May 2001
7. W. W. Cohen, Fast effective rule induction, Proceedings of 12th International conference on machine learning, California, 1995
8. J. R. Quinlan, C4.5: Programs for machine learning, Morgan Kaufmann, 1993
9. K. Kendall, A database of computer attacks for the evaluation of intrusion detection systems, Thesis, MIT, 1999
10. DARPA Intrusion Detection Evaluation Data Set, http://www.ll.mit.edu/IST/ ideval/data/dataindex.html
11. S. Axelsson, The base-rate fallacy and the difficulty of Intrusion Detection, ACM Transactions on Information and System Security, vol.3, No.3, Aug 2000
12. Accuracy Paradox, http://en.wikipedia.org/wiki/Accuracy_paradox
13. M. V. Joshi, On evaluating performance of classifiers for rare classes, Proceedings of the 2002 IEEE International Conference on data mining, pp. 641-644, 2002
14. R. Agarwal and M. V. Joshi, PN rule: A new framework for learning classifier models in data mining (a case-study in network intrusion detection), Technical Report RC 21719, IBM Research report, Computer Science/Mathematics, April 2000
15. P. Chan, S. Stolfo, Towards scalable learning with non-uniform class and cost distributions: A case study in credit card fraud detection, Proceedings of 4rth International Conference on knowledge discovery and data mining (KDD-98), pp 164-168, 1998
16. R. C. Holte, N. Japkowicz, C. X. Ling, Learning from imbalanced data sets, Technical Report WS-00-05, AAAI Press, Menlo Park, CA, 2000
17. W. Lee, W. Fan, M. Miller, S. Stolfo, E. Zadok, Toward cost-sensitive modeling for intrusion detection and response, Technical report CUCS-002-00, Computer Science, Columbia University, 2000
18. C. Elkan, Results of the KDD'99 classifier learning, SIGKDD Explorations, Vol. 1, Issue 2, pp. 63-64, Jan 2000
19. C. Thomas, N. Balakrishnan, Selection of Intrusion Detection Threshold Bounds for effective Sensor Fusion, Proceedings of SPIE Defense and Security Conference, 6570-5, Orlando, Florida, April 2007
20. C. Thomas, N. Balakrishnan, Performance Enhancement of Intrusion Detection Systems using Data-Dependent Decision Fusion (submitted to Journal of Computer Security)
21. R. Perdisci, G.Giacinto, F. Roli, Alarm clustering for intrusion detection systems in computer networks, Engg. applications of Artificial Intelligence, Elsevier publications, March 2006
22. A. Valdes, K. Skinner, Probabilistic alert correlation, Springer Verlag notes in Computer Science, 2001
23. F. Cuppens, A. Miege, Alert correlation in a cooperative intrusion detection framework, Proceedings of the 2002 IEEE symposium on security and privacy, 2002
24. C. Siaterlis, B. Maglaris, Towards Multisensor Data Fusion for DoS detection, ACM Symposium on Applied Computing, 2004
25. T. Bass, Multisensor Data Fusion for Next Generation Distributed Intrusion Detection Systems, IRIS National Symposium, 1999
26. G. Giacinto, F. Roli, L. Didaci, Fusion of multiple Classifiers for Intrusion Detection in Computer Networks, Pattern Recognition Letters, 24, pp. 1795-1803, 2003
27. L. Didaci, G. Giacinto, F. Roli, Intrusion detection in computer networks by multiple classifiers systems, International Conference on Pattern Recognition, 2002
28. Y. Wang, H. Yang, X. Wang, R. Zhang, Distributed intrusion detection system based on data fusion method, Intelligent control and automation, WCICA 2004
29. W. Hu, J. Li, Q. Gao, Intrusion Detection Engine on Dempster-Sharer's Theory of Evidence, Proceedings of International Conference on Communications, Circuits and Systems, vol.3, pp. 1627-1631, Jun 2006
30. A. Siraj, R. B. Vaughn, S. M. Bridges, Intrusion Sensor Data Fusion in an Intelligent Intrusion Detection System Architecture, Proceedings of the 37th Hawaii international Conference on System Sciences, 2004
31. M. V. Mahoney, P. K. Chan, Detecting Novel attacks by identifying anomalous Network Packet Headers, Florida Institute of Technology Technical Report CS-2001-2
32. M. V. Mahoney and P. K. Chan, Learning non stationary models of normal network traffic for detecting novel attacks, SIGKDD, 2002
33. www.snort.org/docs/snort_htmanuals/htmanual_260
34. R. P. Lippmann, R. K. Cunningham, Improving Intrusion Detection Performance using keyword selection and Neural Networks, Web proceedings of the 2nd International Workshop on Recent Advances in Intrusion Detection, 1999
35. J. McHugh, Testing Intrusion Detection Systems: A critique of the 1998 and 1999 DARPA IDS evaluations as performed by Lincoln Laboratory, ACM Transactions on information and system security, vol 3, No.4, Nov 2000
36. M. V. Mahoney, P. K. Chan, An analysis of the 1999 DARPA/ Lincoln Laboratory evaluation data for network anomaly detection, Technical Report CS-2003-02
37. C. Thomas, V. Sharma, N. Balakrishnan, Usefulness of DARPA data set for Intrusion Detection Systems Evaluation, Proc. of the SPIE, Defense and Security Symposium, Mar. 2008 (accepted for publication)
38. M. Kubat, R. C. Holte, S. Matwin, Machine learning for the detection of oil spills in satellite radar images, Machine Learning, 30: 195-215, 1998