Intrusion signature creation via clustering anomalies

Proceedings of SPIE - The International Society for Optical Engineering

Volumn 6973, Issue , 2008, Pages

  Hendry, Gilbert R ^a   Yang, Shanchieh J ^a  

^a ROCHESTER INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

Adaptive signatures; Clustering; Intrusion detection

Indexed keywords

CLASSIFICATION (OF INFORMATION); CLUSTERING ALGORITHMS; COMPUTER CRIME; REAL TIME CONTROL; RELIABILITY THEORY; SUPERVISED LEARNING;

ADAPTIVE SIGNATURES; CLUSTERING; CYBER ATTACKS;

INTRUSION DETECTION;

EID: 43249101215     PISSN: 0277786X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1117/12.775886     Document Type: Conference Paper

References (23)

1. Sourcefire, "Snort: An Open Source Network Intrusion Prevention and Detection System." http://www.snort.org, 2007.
2. Enterasys Networks Inc., "Dragon Intrusion Detection System." http://www.enterasys.com/products/ids/DSHSS7/.
3. S. International, "NIDES (Next-Generation Intrusion Detection Expert System)." http://www.csl.sri.com/projects/nides/.
4. S. Patton, W. Yurcik, and D. Doss, "An achules' heel in signature-based IDS: Squealing false positives in Snort," 2001.
5. Y. Guan, A. A. Ghorbani, and N. Belacel, "Y-means: a clustering method for intrusion detection," in Proceedings of CCECE 2003 - Canadian Conference on Electrical and Computer Engineering Toward a Caring and Humane Technology, 2, pp. 1083-6, (Montreal, Que., Canada), May 2003.
6. J.-L. Zhao, J.-F. Zhao, and J.-J. Li, "Intrusion detection based on clustering genetic algorithm," in Proceedings of 2005 International Conference on Machine Learning and Cybernetics, 6, pp. 3911-14, (Guangzhou, China), August 2005.
7. S.-H. Oh, J.-S. Kang, Y.-C. Byun, G.-L. Park, and S.-Y. Byun, "Intrusion detection based on clustering a data stream," in Proceedings of Third ACIS International Conference on Software Engineering Research, Management and Applications, pp. 220-7, (Mount Pleasant, MI, USA), August 2005.
8. K. Sequeira and M. Zaki, "ADMIT: Anomaly-based Data Mining for Intrusions," in Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 386-395, 2002.
9. H. Shah, J. Undercoffer, and A. Joshi, "Fuzzy clustering for intrusion detection," in Proceedings of the 12th IEEE International Conference on Fuzzy Systems, 2, pp. 1274-8, (St Louis, MO, USA), May 2003.
10. S. Jiang, X. Song, H. Wang, J.-J. Han, and Q.-H. Li, "A clustering-based method for unsupervised intrusion detections," Pattern Recognition Letters 27, pp. 802-10, May 2006.
11. N. Ye and X. Li, "A scalable clustering technique for intrusion signature recognition," in Proceedings off 2001 IEEE Workshop on Information Assurance and Security, pp. 1-4, 2001.
12. Z. Li, A. Das, and J. Zhou, "USAID: Unifying Signature-based and Anomaly-based Intrusion Detection," in Proceedings of 9th Pacific-Asia Conference on Advances in Knowledge Discovery and Data Mining, PAKDD 2005, pp. 702-712, (Hanoi, Viet Nam), May 2005.
13. D. F. Gong, "White paper: Deciphering detection techniques: Part ii anomaly-based intrusion detection," Network Associates, 2003.
14. I.-Y. Weon, D. H. Song, and C.-H. Lee, "Effective intrusion detection model through the combination of a signaturebased intrusion detection system and a machine learning-based intrusion detection system," Journal of Information Science and Engineering 22(6), pp. 1447-1464, 2006.
15. O. Depren, M. Topallar, E. Anarim, and M. K. Ciliz, "An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks," Expert Systems with Applications 29(4), pp. 713-22, 2005.
16. I. Bojanic, "On-line adaptive IDS scheme for detecting unknown network attacks using hmm models," 2005.
17. S. Mukkamala, G. Janoski, and A. Sung, "Intrusion detection using neural networks and support vector machines," in Proceedings of 2002 International Joint Conference on Neural Networks (IJCNN), 2, pp. 1702-7, (Honolulu, HI, USA), May 2002.
18. S. Chavan, K. Shah, N. Dave, S. Mukherjee, A. Abraham, and S. Sanyal, "Adaptive neuro-fuzzy intrusion detection systems," in Proceedings of ITCC 2004. International Conference on Information Technology: Coding and Computing, 1, pp. 70-4, (Las Vegas, NV, USA), April 2004.
19. R. Vaarandi, "A Data Clustering Algorithm for Mining Patterns from Event Logs," in Proceedings of the 3rd IEEE Workshop on IP Operations and Management (IPOM 2003), pp. 119-26, (Kansas City, MO, USA), October 2003.
20. "Case Study: Defending the Nation's Lawmakers Against Cyber Threats and Attacks," Network Associates, 2003.
21. S. Hettich and S. D. Bay, "The UCI KDD Archive." http://kdd.ics.uci.edu, 1999.
22. A. Clare, "Machine learning and data mining for yeast functional genomics, phd thesis," Department of Computer Science University of Wales, Aberystwyth, 2003.
23. MIT Lincoln Laboratory, "1999 DARPA Intrusion Detection Evaluation Data Set," 1999. http://www.ll.mit.edu/IST/ideval/data/1999/ 1999_data_index.html.