A clustering-based anomaly intrusion detector for a host computer

IEICE Transactions on Information and Systems

Volumn E87-D, Issue 8, 2004, Pages 2086-2094

  Oh, Sang Hyun ^a   Lee, Won Suk ^a  

^a Yonsei University   (South Korea)

Author keywords

Anomaly detection; Clustering; Data mining; Intrusion detection; User profiling

Indexed keywords

ALGORITHMS; MATHEMATICAL MODELS; RELIABILITY; SECURITY OF DATA; SEMANTICS; STATISTICAL METHODS;

ANOMALY DETECTION; CLUSTERING; INTRUSION DETECTION; USER PROFILING;

DATA MINING;

EID: 4344644051     PISSN: 09168532     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (28)

1. B. Mukherjee, T.L. Heberlein, and K.N. Kevitt, "Network intrusion detection," IEEE Netw., vol.8, no.3, pp.26-41, May/June 1994.
2. R. Heady, G. Luger, A. Maccabe, and M. Servilla, "The architecture of a network level intrusion detection system," Technical Report, Computer Science Department, University of New Mexico, Aug. 1990.
3. K. Ilgun, R. Kemmerer, and P.A. Porras, "State transition analysis: A rule-based intrusion detection approach," IEEE Trans. Softw. Eng., vol.21, no.3, pp.181-199, March 1995.
4. K. Illgun, "USTAT: A real-time intrusion detection system for UNIX," Proc. 1993 Symposium Security and Privacy, pp.16-28, May 1993.
5. H.S. Javitz and A. Valdes, "The SRI IDES statistical anomaly detector," Proc. 1991 IEEE Symposium on Research in Security and Privacy, May 1991.
6. H.S. Javitz and A. Valdes, "The NIDES statistical component description and justification," Annual Report, SRI International, 333 Ravenwood Avenue, Menlo Park, CA 94025, March 1994.
7. P.A. Porras and P.G. Neumann, "EMERALD: Event monitoring enabling responses to anomalous live disturbances," 20th NISSC, Oct. 1997.
8. W. Lee and S. Stolfo, "Data mining approaches for intrusion detection," Proc. 7th USENIX Security Symposium, San Antonio, Texas, Jan. 1998.
9. W. Lee, S.J. Stolfo, and P.K. Chan, "Learning patterns from unix process execution traces for intrusion detection," Proc. AAAI-97 Work, on AI Methods in Fraud and Risk Management, 1997.
10. S.J. Stolfo, A.L. Prodromidis, S. Tselepis, W. Lee, D. Fan, and P.K. Chan, "JAM: Java agents for meta-learning over distributed databases, " Proc. KDD-97 and AAAI97 Work on AI Methods in Fraud and Risk Management, 1997.
11. H. Mannila, H. Toivonen, and A.I. Verkamo, "Discovering frequent episodes in sequences," KDD-95, pp.210-215, AAAI Press, Montreal, Canada, Aug. 1995.
12. R. Agrawal and R. Srikant, "Mining sequential patterns," Proc. Int. Conf. on Data Engineering (ICDE), Taipei, Taiwan, March 1995.
13. M. Ester, H.-P. Kriegel, J. Sander, M. Wimmer, and X. Xu, "Incremental clustering for mining in a data warehousing environment, " Proc. 24th VLDB Conference, New York, USA, 1998.
14. S. Guha, R. Rastogi, and K. Shim, "ROCK: A clustering algorithm for categorical attributes," 15th Int. Conf. on IEEE Data Engineering, Sydney, Australia, 1999.
15. S. Guha, R. Rastogi, and K. Shim, "CURE: An efficient clustering algorithm for large databases," ACM SIGMOD Int. Conf. on Management of Data, Seattle, Washington, 1998.
16. T. Zhang, R. Ramakrishnan, and M. Livny, "Birch: An efficient data clustering method for very large databases," Proc. ACM SIGMOD Conference on Management of Data, Montreal, Canada, June 1996.
17. S. Kumar, Classification and Detection of Computer Intrusions, Ph.D. Dissertation, Purdue University, Aug. 1995
18. T.D. Garvey and T.F. Lunt, "Model based intrusion detection," Proc. 14th National Computer Security Conference, pp.372-385, Oct. 1991.
19. J.S. Balesubramaniyan, J.O. Garcia-Fernandes, D. Isacoff, E. Spafford, and D. Zamboni, "An architecture for intrusion detection using autonomous agents," Technical Report 98-05, COAST Laboratory, Purdue University, West Lafayette, IN, May 1998.
20. R. Agrawal and R. Srikant, "Fast algorithms for mining association rules," Proc. 20th Int. Conf. on Very Large Databases, Santiago, Chile, Sept. 1994.
21. Sun Microsystems, SunShield Basic Security Module Guide, 1995.
22. R. Agrawal, J. Gehrke, D. Gunopulos, and P. Raghavan, "Automatic subspace clustering of high dimensional data for data mining applications, " Proc. ACM SIGMOD Int. Conf. on Management of Data, Seattle, WA, June 1998.
23. I.V. Cadez, D. Heckerman, C. Meek, P. Smyth, and S. White, "Visualization of navigation patterns on a web site using model-based clustering," Proc. KDD2000, pp.280-284, ACM Press, 2000.
24. A. Ypma and T. Heskes, "Categorization of web pages and user clustering with mixtures of hidden Markov models," Proc. 2002 KDD Workshop on Web Mining, pp.31-43, 2002.
25. K. Squeira and M. Zaki, "ADMIT: Anomaly-based data mining for intrusions," Proc. KDD2002, pp.386-395, 2002.
26. M. Asaka, T. Onabuta, T. Inoue, S. Okazawa, and S. Goto, "A new intrusion detection method based on discriminant analysis," IEICE Trans. Inf. & Syst., vol.E84-D, no.5, pp.570-577, May 2001.
27. M. Asaka, T. Onabuta, and S. Goto, "Public infomation server for tracing intruders in the Internet," IEICE Trans. Commun., vol.E84-B, no.12, pp.3104-3112, Dec. 2001.
28. T.W. Anderson, An introduction to multivariate statistical analysis, second ed., John Wiley & Sons, New York, 1994.