Random-forests-based network intrusion detection systems

IEEE Transactions on Systems, Man and Cybernetics Part C: Applications and Reviews

Volumn 38, Issue 5, 2008, Pages 649-659

  Zhang, Jiong ^a,b   Zulkernine, Mohammad ^a   Haque, Anwar ^c  

^a QUEEN S UNIVERSITY   (Canada)

^b TELUS   (Canada)

^c Bell Canada   (Canada)

Author keywords

Computer network security; Data mining; Intrusion detection; Random forests

Indexed keywords

ADMINISTRATIVE DATA PROCESSING; ALGORITHMS; BOOLEAN FUNCTIONS; COMPUTER CRIME; COMPUTER NETWORKS; DATA MINING; DECISION SUPPORT SYSTEMS; INFORMATION MANAGEMENT; INTERNET; MINING; RANDOM PROCESSES; SECURITY OF DATA; SIGNAL DETECTION;

ANOMALY DETECTIONS; COMPUTER NETWORK SECURITY; RANDOM FORESTS;

INTRUSION DETECTION;

EID: 50649094035     PISSN: 10946977     EISSN: None     Source Type: Journal    
DOI: 10.1109/TSMCC.2008.923876     Document Type: Article

References (39)

1. CSI/FBI Computer Crime and Security Survey. (2004). Computer Security Inst., San Francisco, CA. [Online]. Available: http://www.issa-sac.org/ docs/FBI2004.pdf
2. L. Breiman and A. Cutler, Random Forests. (2006). [Online]. Available: http://stat-www.berkeley.edu/users/breiman/RandomForests/cchome.htm
3. DARPA Intrusion Detection Evaluation. (2006). [Online]. Available: http://www.ll.mit.edu/IST/ideval/
4. Snort Network Intrusion Detection System. (2006). [Online]. Available: http://www.snort.org
5. WEKA software. (2006). [Online]. Available: http://www.cs.waikato.ac.nz/ ml/weka/
6. T. Abraham, "IDDM: Intrusion detection using data mining techniques," DSTO Electron. Surveill. Res. Lab., Salisbury, Australia, Tech. Rep. DSTO-GD-0286, May 2001.
7. D. Anderson, T. Frivold, and A. Valdes, "Next-generation intrusion detection expert system (NIDES) - A summary," SRI Int., Menlo Park, CA, Tech. Rep. SRI-CSL-95-07, May 1995.
8. D. Barbara, J. Couto, S. Jajodia, L. Popyack, and N. Wu, "ADAM: Detecting intrusions by data mining," in Proc. 2nd Annu. IEEE Workshop Inf. Assur. Secur., New York, Jun. 2001, pp. 11-16.
9. D. Barbara and S. Jajodia, Applications of Data Mining in Computer Security. Norwell, MA: Kluwer, 2002.
10. V. Barnett and T. Lewis, Outliers in Statistical Data. New York: Wiley, 1994.
11. A. Bivens, M. Embrechts, C. Palagiri, R. Smith, and B. Szymanski, "Network-based intrusion detection using neural networks," in Proc. Artif. Neural Netw. Eng., St. Louis, MO, Nov. 2002, vol. 12, pp. 527-535.
12. L. Breiman, "Random forests," Mach. Learn., vol. 45, pp. 5-32, 2001.
13. R. Duda, P. Hart, and D. Stork, Pattern Classification. New York: Wiley, 2000.
14. C. Elkan, "Results of the KDD'99 classifier learning," SIGKDD Explorations, vol. 1, no. 2, pp. 63-64, 2000.
15. C. Endorf, E. Schultz, and J. Mellander, Intrusion Detection & Prevention. New York: McGraw-Hill, 2004.
16. E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo, "A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data," in Applications of Data Mining in Computer Security Norwell, MA: Kluwer, 2002.
17. L. Guo, Y. Ma, B. Cukic, and H. Singh, "Robust prediction of fault-proneness by random forests," in Proc. 15th Int. Symp. Softw. Rel. Eng. (ISSRE), Brittany, France, Nov. 2004, pp. 417-428.
18. D. Hand, H. Mannila, and P. Smyth, Principles of Data Mining. Cambridge, MA: MIT Press, Aug. 2001.
19. W. Lee and S. Stolfo, "A framework for constructing features and models for intrusion detection systems," ACM Trans. Inf. Syst. Secur., vol. 3, no. 4, pp. 227-261, Nov. 2000.
20. W. Lee and S. Stolfo, "Data mining approaches for intrusion detection," in Proc. 7th USENIX Secur. Symp., San Antonio, TX, Jan. 1998, pp. 79-83.
21. K. Leung and C. Leckie, "Unsupervised anomaly detection in network intrusion detection using clusters," in Proc. 28th Australasian CS Conf., Newcastle, Australia, Jan. 2005, vol. 38, pp. 333-342.
22. C. Lu, D. Chen, and Y. Kou, "Algorithms for spatial outlier detection," in Proc. 3rd IEEE Int. Conf. Data Mining, Melbourne, FL, Nov. 2003, pp. 597-600.
23. M. Mahoney and P. Chan, "An analysis of the 1999 DARPA/Lincoln Laboratory evaluation data for network anomaly detection," in Proc. Recent Adv. Intrusion Detect. (RAID), Pittsburgh, PA, Sep. 2003, Lecture Notes in Computer Science, vol. 2820, pp. 220-237.
24. S. Bridges and R. Vaughn, "Fuzzy data mining and genetic algorithms applied to intrusion detection," in Proc. Nat. Inf. Syst. Secur. Conf. (NISSC), Baltimore, MD, Oct. 2000, pp. 13-31.
25. B. Popescu and J. Friedman, "Ensemble learning for prediction," Doctoral dissertation, Stanford Univ., Stanford, CA, Jan. 2004.
26. M. Ramadas, S. Ostermann, and B. Tjaden, "Detecting anomalous network traffic with self-organizing maps," in Proc. Recent Adv. Intrusion Detect. (RAID), Pittsburgh, PA, Sep. 2003, Lecture Notes in Computer Science, vol. 2820, pp. 36-54.
27. R. Smith, A. Bivens, M. Embrechts, C. Palagiri, and B. Szymanski, "Clustering approaches for anomaly based intrusion detection," presented at the 1st Annu. Walter Lincoln Hawkins Graduate Res. Conf., New York, Oct. 2002.
28. K. Tan, K. Killourhy, and R. Maxion, "Undermining an anomaly based intrusion detection system using common exploits," in Proc. Recent Adv. Intrusion Detect. (RAID), Zurich, Switzerland, Oct. 2002, pp. 54-73.
29. E. Tombini, H. Debar, L. Me, and M. Ducasse, "A serial combination of anomaly and misuse IDSes applied to HTTP traffic," in Proc. 20th Annu. Comput. Secur. Appl. Conf., Tucson, AZ, Dec. 2004, pp. 428-437.
30. Q. Tran, H. Duan, and X. Li, "One-class support vector machine for anomaly network traffic detection," presented at the 2nd Netw. Res. Workshop 18th APAN, Cairns, Australia, Jul. 2004.
31. T. Wu, C. Lin, and R. Weng, "Probability estimates for multi-class classification by pairwise coupling," J. Mach. Learn. Res., vol. 5, pp. 975-1005, Dec. 2004.
32. J. Zhang and M. Zulkernine, "Network intrusion detection using random forests,"in Proc. 3rd Annu. Conf. Privacy, Secur. Trust (PST), St. Andrews, NB, Canada, Oct. 2005, pp. 53-61.
33. J. Zhang and M. Zulkernine, "A hybrid network intrusion detection technique using random forests," in Proc. Int. Conf. Availability, Reliability Secur. (AReS). Vienna, Austria: IEEE CS Press, Apr. 2006, pp. 262-269.
34. J. Zhang and M. Zulkernine, "Anomaly based network intrusion detection with unsupervised outlier detection," in Proc. IEEE Int. Conf. Commun. (ICC) - Symp. Netw. Secur. Inf. Assur., Istanbul, Turkey, Jun. 2006, vol. 5, pp. 2388-2393.
35. Q. Zhou, L. Gu, C. Wang, J. Wang, and S. Chen, "Using an improved C4.5 for imbalanced dataset of intrusion," in Proc. 4th Annu. Privacy Secur. Trust Conf., Markham, Canada, Oct. 2006, pp. 481-484.
36. Y. Zhang, Y. Zhong, and X. Wang, "Distributed intrusion detection based on clustering," in Proc. 4th Int. Conf. Mach. Learn. Cybern., Guangzhou, China, Aug. 2005, vol. 4, pp. 2379-2383.
37. W. Hu and W. Hu, "Network-based intrusion detection using adaboost algorithm," in Proc. IEEE/WIC/ACM Int. Conf. Web Intell., Sep. 2005, pp. 712-717.
38. J. McHugh, "Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA offline intrusion detection system evaluation as performed by Lincoln Laboratory," ACM Trans. Inf. Syst. Secur., vol. 3, no. 4, pp. 262-294, Nov. 2000.
39. W. Lee, S. Stolfo, and K. Mok, "Adaptive intrusion detection: A data mining approach," Artif. Intell. Rev., vol. 14, pp. 533-567, Dec. 2000.