Unsupervised learning algorithms for intrusion detection

NOMS 2008 - IEEE/IFIP Network Operations and Management Symposium: Pervasive Management for Ubiquitous Networks and Services

Volumn , Issue , 2008, Pages 1043-1048

  Zanero, Stefano ^a   Serazzi, Giuseppe ^a  

^a POLITECNICO DI MILANO   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

FINANCIAL DATA PROCESSING; INTERNET; INTRUSION DETECTION; LEARNING ALGORITHMS; LEARNING SYSTEMS; UBIQUITOUS COMPUTING; UNSUPERVISED LEARNING;

EXISTING SYSTEMS; NETWORK INTRUSION DETECTION; NETWORK OPERATIONS; PACKET PAYLOADS; PACKET STREAMS; PERFORMANCE RESULTS; RESEARCH RESULTS; UBIQUITOUS NETWORKS; UNSUPERVISED LEARNING ALGORITHMS;

NETWORK MANAGEMENT;

EID: 51849157912     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NOMS.2008.4575276     Document Type: Conference Paper

References (37)

1. J. P. Anderson, "Computer security threat monitoring and surveillance," J. P. Anderson Co., Ft. Washington, Pennsylvania, Tech. Rep., Apr 1980.
2. R. G. Bace, Intrusion detection. Indianapolis, IN, USA: Macmillan Publishing Co., Inc., 2000.
3. T. H. Ptacek and T. N. Newsham, "Insertion, evasion, and denial of service: Eluding network intrusion detection," Secure Networks, Calgary, Canada, Tech. Rep. T2R-0Y6, 1998. [Online]. Available: citeseer.nj.nec.com/ ptacek98insertion.html
4. S. Zanero, "Unsupervised learning algorithms for intrusion detection," Ph.D. dissertation, Politecnico di Milano T.U., May 2006. [Online]. Available: http://home.dei.polimi.it/zanero/papers/tesi zanero online.pdf
5. M. Mahoney and P. Chan, "Detecting novel attacks by identifying anomalous network packet headers," Florida Institute of Technology, Tech. Rep. CS-2001-2, 2001.
6. D.-Y. Yeung and C. Chow, "Parzen-Window network intrusion detectors," in Proc. of the 16th Int'l Conf. on Pattern Recognition, vol. 4, aug 2002, pp. 385-388. [Online]. Available: citeseer.nj.nec.com/505644. html
7. K. Labib and R. Vemuri, "NSOM: A real-time network-based intrusion detection system using self-organizing maps," Dept. of Applied Science, University of California, Davis, Tech. Rep., 2002.
8. M. V. Mahoney and P. K. Chan, "A machine learning approach to detecting attacks by identifying anomalies in network traffic," Florida Institute of Technology, Tech. Rep. CS-2002-08, 2002.
9. M. V. Mahoney, "Network traffic anomaly detection based on packet bytes," in Proceedings of the 19th Annual ACM Symposium on Applied Computing, 2003.
10. M. V. Mahoney and P. K. Chan, "Learning rules for anomaly detection of hostile network traffic," in Proc. of the 3rd IEEE Int'l Conf. on Data Mining, 2003, p. 601.
11. _, "Learning nonstationary models of normal network traffic for detecting novel attacks," in KDD '02: Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining. New York, NY, USA: ACM Press, 2002, pp. 376-385.
12. K. Wang and S. J. Stolfo, "Anomalous payload-based network intrusion detection," in RAID Symposium, September 2004.
13. S. Zanero and S. M. Savaresi, "Unsupervised learning techniques for an intrusion detection system," in Proc. of the 2004 ACM Symposium on Applied Computing. ACM Press, 2004, pp. 412-419.
14. J. Han and M. Kamber, Data Mining: concepts and techniques. Morgan-Kauffman, 2000.
15. S. Zanero, "Analyzing tcp traffic patterns using self organizing maps," ser. Lecture Notes in Computer Science, F. Roli and S. Vitulano, Eds., vol. 3617. Cagliari, Italy: Springer, September 2005, pp. 83-90.
16. D. Hawkins, Identification of Outliers. London: Chapman and Hall, 1980.
17. D. Boley, V. Borst, and M. Gini, "An unsupervised clustering tool for unstructured data," in IJCAI 99 Int'l Joint Conf. on Artificial Intelligence, Stockholm, Aug 1999.
18. T. Kohonen, Self-Organizing Maps, 3rd ed. Berlin: Springer-Verlag, 2001.
19. I. T. Jolliffe, Principal Component Analysis. Springer Verlag, 1986.
20. S. Zanero, "Improving self organizing map performance for network intrusion detection," in SDM 2005 Workshop on "Clustering High Dimensional Data and its Applications", 2005.
21. S. McCreary and K. Claffy, "Trends in wide area ip traffic patterns - a view from ames internet exchange," in Proc. of ITC'2000, 2000.
22. K. Beyer, J. Goldstein, R. Ramakrishnan, and U. Shaft, "When is "nearest neighbor" meaningful?" Lecture Notes in Computer Science, vol. 1540, pp. 217-235, 1999. [Online]. Available: citeseer.ist.psu.edu/beyer99when.html
23. A. Hinneburg, C. C. Aggarwal, and D. A. Keim, "What is the nearest neighbor in high dimensional spaces?" in The VLDB Journal, 2000, pp. 506-515. [Online]. Available: citeseer.ist.psu.edu/hinneburg00what.html
24. C. C. Aggarwal, A. Hinneburg, and D. A. Keim, "On the surprising behavior of distance metrics in high dimensional space," Lecture Notes in Computer Science, vol. 1973, 2001. [Online]. Available: citeseer.ist.psu.edu/aggarwal01surprising.html
25. C. C. Aggarwal, "On effective classification of strings with wavelets," in KDD '02: Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining. New York, NY, USA: ACM Press, 2002, pp. 163-172.
26. V. Hodge and J. Austin, "A survey of outlier detection methodologies," Artif. Intell. Rev., vol. 22, no. 2, pp. 85-126, 2004.
27. P. Lichodzijewski, A. Zincir-Heywood, and M. Heywood, "Dynamic intrusion detection using self organizing maps," in 14th Annual Canadian Information Technology Security Symp., May 2002.
28. J. Lin, E. Keogh, and W. Truppel, "Clustering of streaming time series is meaningless," in DMKD '03: Proceedings of the 8th ACM SIGMOD workshop on Research issues in data mining and knowledge discovery. New York, NY, USA: ACM Press, 2003, pp. 56-65.
29. S. Kirshner, "Modeling of multivariate time series using hidden markov models," Ph.D. dissertation, Department of Computer Science, University of California, Irvine, March 2005.
30. K. Yamanishi, J. ichi Takeuchi, G. J. Williams, and P. Milne, "On-line unsupervised outlier detection using finite mixtures with discounting learning algorithms," in Proc. of the 6th ACM SIGKDD Int'l Conf. on Knowledge Discovery and Data Mining, Aug 2000, pp. 320-324. [Online]. Available: citeseer.nj.nec.com/yamanishi00line.html
31. K. Yamanishi, J.-I. Takeuchi, G. J. Williams, and P. Milne, "Online unsupervised outlier detection using finite mixtures with discounting learning algorithms," Knowledge Discovery and Data Mining, vol. 8, no. 3, pp. 275-300, 2004.
32. K. Yamanishi and J. ichi Takeuchi, "Discovering outlier filtering rules from unlabeled data: combining a supervised learner with an unsupervised learner," in KDD '01: Proceedings of the seventh ACM SIGKDD international conference on Knowledge discovery and data mining. New York, NY, USA: ACM Press, 2001, pp. 389-394.
33. I. Guyon and A. Elisseeff, "An introduction to variable and feature selection," Journal of Machine Learning Research, vol. 3, pp. 1157-1182, 2003.
34. S. Pal and P. Mitra, Pattern Recognition Algorithms for Data Mining: Scalability, Knowledge Discovery, and Soft Granular Computing. Boca Raton, FL: Chapman Hall/CRC Press, May 2004.
35. R. Lippmann, J. W. Haines, D. J. Fried, J. Korba, and K. Das, "Analysis and results of the 1999 DARPA off-line intrusion detection evaluation," in Proceedings of the Third International Workshop on Recent Advances in Intrusion Detection. London, UK: Springer-Verlag, 2000, pp. 162-182.
36. "KDD Cup '99 Dataset," available online at http://kdd.ics.uci. edu/ databases/kddcup99/kddcu99.html.
37. "Fragroute," available online at URL http://www.monkey.org/ ~dugsong/fragroute/.