Anomaly intrusion detection by clustering transactional audit streams in a host computer

Information Sciences

Volumn 180, Issue 12, 2010, Pages 2375-2389

  Park, Nam Hun ^a   Oh, Sang Hyun ^b   Lee, Won Suk ^b  

^a Anyang University   (South Korea)

^b Yonsei University   (South Korea)

Author keywords

Anomaly detection; Clustering data streams; Intrusion detection

Indexed keywords

ANOMALY DETECTION; ANOMALY INTRUSION DETECTION; AUDIT DATA; CLUSTERING DATA; CLUSTERING DATA STREAMS; CONVENTIONAL DATA MINING; DATA STREAM; FREQUENCY RANGES; HOST COMPUTERS; NORMAL BEHAVIOR; STATIC BEHAVIORS; STATISTICAL GRID-BASED CLUSTERING;

CLUSTERING ALGORITHMS; COMPUTER HARDWARE DESCRIPTION LANGUAGES; DATA COMMUNICATION SYSTEMS; DATA MINING; HYDRAULICS;

INTRUSION DETECTION;

EID: 77950298520     PISSN: 00200255     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ins.2010.03.001     Document Type: Article

References (25)

1. Rakesh Agrawal, Johannes Gehrke, Dimitrios Gunopulos, Prabhakar Raghavan, Automatic subspace clustering of high dimensional data for data mining applications, in: Proceedings of the ACM SIGMOD International Conference on Management of Data, Seattle, Washington, 1998, pp. 94-105.
2. Charu C. Aggarwal, Jiawei Han, Jianyong Wang, Philip S. Yu, A framework for clustering evolving data streams, in: Proceedings of the VLDB 29th, Berlin, 2003, pp. 81-92.
3. Chang J.H., and Lee W.S. Finding recently frequent itemsets adaptively over online transactional data streams. Information Systems 31 8 (2006) 849-869
4. C.H. Cheng, A.W. Fu, Y. Zhang, Entropy-based subspace clustering for mining numerical data, in: Proceedings of ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD-99), San Diego, 1999, pp. 84-93.
5. DARPA Intrusion Detection Evaluation, .
6. M. Ester, H.-P. Kriegel, J. Sander, X. Xu, A density-based algorithm for discovering clusters in large spatial databases with noise, in: Proceedings of the Second International Conference on Knowledge Discovery and Data Mining (KDD '96), Portland, Oregon, 1996, pp. 226-231.
7. Sudipto Guha, Rajeev Rastogi, Kyuseok Shim, CURE: an efficient clustering algorithm for large databases, in: ACM SIGMOD International Conference on Management of Data, Seattle, Washington, 1998, pp. 73-84.
8. Guha S., Meyerson A., Mishra N., Motwani R., and O'Callaghan L. Clustering data streams: theory and practice. IEEE Transactions on Knowledge and Data Engineering 15 3 (2003) 515-528
9. Illgun K., Kemmerer R., and Porras P.A. State transition analysis: a rule-based intrusion detection approach. IEEE Transaction on Software Engineering 21 (1995) 181-199
10. K. Illgun, USTAT: a real-time intrusion detection system for UNIX, in: Proceedings of the 1993 Symposium Security and Privacy, 1993, pp. 16-28.
11. J. MacQueen, Some methods for classification and analysis of multivariate observations, in: Proceedings of the Fifth Berkeley Symposium, 1996, pp. 281-297.
12. H.S. Javitz, A. Valdes, The SRI IDES statistical anomaly detector, in: Proceedings of the 1991 IEEE Symposium on Research in Security and Privacy, 1991, pp. 316-326.
13. Harold S. Javitz, Alfonso Valdes, The NIDES statistical component description and justification, Annual report, SRI International, 1994.
14. Katos V. Network intrusion detection: evaluating cluster, discriminant, and logit analysis. Information Sciences 177 15 (2007) 3060-3073
15. W. Lee, S. Stolfo, Data mining approaches for intrusion detection, in: Proceedings of the Seventh USENIX Security Symposium, San Antonio, Texas, 1998, pp. 6-6.
16. Sang Hyun Oh, Won Suk Lee, Optimized Clustering for Anomaly Intrusion Detection, PAKDD, 2003, pp. 576-581.
17. Oh S.H., and Lee W.S. An anomaly intrusion detection method by clustering normal user behavior. Computers and Security 22 7 (2003) 596-612
18. Park N.H., and Lee W.S. A statistical grid-based clustering over data streams. ACM SIGMOD Record 33 1 (2004) 32-37
19. Phillip A. Porras, Peter G. Neumann, EMERALD: event monitoring enabling responses to anomalous live disturbances, 20th NISSC, 1997, pp. 353-365.
20. Shon T., and Moon J. A hybrid machine learning approach to network anomaly detection. Information Sciences 177 18 (2007) 3799-3821
21. W. Wang, J. Yang, R. Muntz, Sting: a statistical information grid approach to spatial data mining, in: Proceedings of the 23th International Conference on Very Large Data Bases, 1997, pp. 186-195.
22. Henry S. Teng, Kaihu Chen, Stephen C. Lu, Security audit trail analysis using inductively generated predictive rules, in: Proceedings of the Sixth Conference on Artificial Intelligence Applications, Piscataway, New Jersey, 1990, pp. 24-29.
23. Sun Microsystems, SunShield Basic Security Module Guide, .
24. Tian Zhang, Raghu Ramakrishnan, Miron Livny, Birch: an efficient data clustering method for very large databases, in: Proceedings for the ACM SIGMOD Conference on Management of Data, Montreal, Canada, 1996, pp. 103-114.
25. Chang J.H., and Kum H.-C. Frequency-based load shedding over a data stream of tuples. Information Sciences 179 21 (2009) 3733-3744