A novel unsupervised classification approach for network anomaly detection by k-Means clustering and ID3 decision tree learning methods

Journal of Supercomputing

Volumn 53, Issue 1, 2010, Pages 231-245

  Yasami, Yasser ^a   Mozaffari, Saadat Pour ^a  

^a AMIRKABIR UNIVERSITY OF TECHNOLOGY   (Iran)

Author keywords

Address Resolution Protocol (ARP); Anomaly detection; ID3 decision tree; K Means clustering; Markovian chain; Stochastic learning automata; Unsupervised classification

Indexed keywords

ADDRESS RESOLUTION PROTOCOL; ANOMALY DETECTION; K-MEANS CLUSTERING; MARKOVIAN CHAIN; STOCHASTIC LEARNING AUTOMATA; UNSUPERVISED CLASSIFICATION;

AUTOMATA THEORY; CLUSTER ANALYSIS; COMBINATORIAL MATHEMATICS; DECISION TREES; INTERNET PROTOCOLS; LEARNING ALGORITHMS; ROBOTS; STOCHASTIC SYSTEMS; TRANSLATION (LANGUAGES); WATER SUPPLY SYSTEMS;

CLUSTERING ALGORITHMS;

EID: 77953620856     PISSN: 09208542     EISSN: 15730484     Source Type: Journal    
DOI: 10.1007/s11227-009-0338-x     Document Type: Conference Paper

References (30)

1. Agarwal R, Joshi MV (2000) PNrule: a new framework for learning classifier models in data mining (A case-study in network intrusion detection). Technical Report DSTO-GD-0286, Dept of Computer Science, Univ of Minnesota
2. Ármannsson D, Hjálmtýsson G, Smith PD, Mathy L (2005) Controlling the effects of anomalous ARP behaviour on Ethernet networks. In: Proc of the 2005 ACM conference on emerging network experiment and technology, 2005, pp 50-60
3. Duda R, Hart P, Stork D (2000) Pattern classification, 2nd edn. Wiley, New York
4. Farahmand M, Azarfar A, Jafari A, Zargari V (2006) A multivariate adaptive method for detecting ARP anomaly in local area networks. In: International conference on systems and networks communication (ICSNC'06), Nov 2006, pp 53-59
5. SR Gaddam VV Phoha KS Balagani 2007 k-Means+ID3: a novel method for supervised anomaly detection by cascading k-Means clustering and ID3 decision tree learning methods IEEE Trans Knowl Data Eng 19 3 345 354 10.1109/TKDE.2007.44 (Pubitemid 46374532)
6. Gomez J, Gupta DD (2001) Evolving fuzzy classifiers for intrusion detection, In: Proc 2002 IEEE workshop information assurance, June 2001
7. Hwang K, Liu H, Chen Y (2004) Protecting network-centric systems with joint anomaly and intrusion detection over Internet episodes. In: IEEE IPDPS- 2005, 8 Oct 2004
8. Javitz HS, Valdes A (1991) The SRI IDES statistical anomaly detector. In: Proc IEEE symp security and privacy, May 1991, pp 316-326
9. J Kittler M Hatef RPW Duin J Matas 1998 On combining classifiers IEEE Trans Pattern Anal Mach Intell 20 3 226 239 10.1109/34.667881
10. Kruegel C, Vigna G (2003) Anomaly detection of Web-Based attacks. In: Proc ACM conf computer and comm security, Oct 2003
11. Kumar S, Spafford EH (1994) A pattern matching model for misuse intrusion detection. In: Proc 17th Nat'l Computer Security Conf, Oct 1994, pp 11-21
12. LI Kuncheva 2002 Switching between selection and fusion in combining classifiers: an experiment IEEE Trans Sys Man Cybern 32 2 146 156 10.1109/3477.990871 (Pubitemid 34249373)
13. Lazarevic A, Ozgur A, Ertoz L, Srivastava J, Kumar V (2003) A comparative study of anomaly detection schemes in network intrusion detection. In: Proc SIAM int'l conf data mining, May 2003
14. Levin I (2000) KDD-99 classifier learning contest: LLSoft's results overview. In: SIGKDD explorations, Jan 2000, vol 1, pp 67-75
15. Maselli G, Deri L (2003) Design and implementation of an anomaly detection system: an empirical approach. In: Proc of Terena TNC 2003, Zagreb, Croatia, May 2003
16. Mitchell T (1997) Machine learning. McGraw-Hill, New York
17. D Mutz F Valeur G Vigna C Kruegel 2006 Anomalous system call detection ACM Trans Inf Syst Secur 9 1 61 93 10.1145/1127345.1127348
18. G Qu S Hariri M Yousif 2005 A new dependency and correlation analysis for features IEEE Trans Knowl Data Eng 17 9 1199 1207 10.1109/TKDE.2005.136 (Pubitemid 46488937)
19. A Ray 2004 Symbolic dynamic analysis of complex systems for anomaly detection Signal Process 84 7 1115 1130 1152.94353 10.1016/j.sigpro.2004.03.011
20. ST Sarasamma QA Zhu J Huff 2005 Hierarchical Kohonen net for anomaly detection in network security IEEE Trans Syst Man Cybern B 35 2 302 312 10.1109/TSMCB.2005.843274 (Pubitemid 40535913)
21. Summary test report core Ethernet switches buffering and control plane performance comparison. Cisco Systems Catalyst 6500 vs. Foundry Networks BigIron 8000. MIER Communications Inc., 12 July 2000
22. M Thottan C Ji 2003 Anomaly detection in IP networks IEEE Trans Signal Process 51 8 2191 2204 10.1109/TSP.2003.814797
23. A Verikas A Lipnickas K Malmqvist M Bacauskiene A Gelzinis 1999 Soft combination of neural classifiers: a comparative study Pattern Recogn Lett 20 429 444 10.1016/S0167-8655(99)00012-4 (Pubitemid 29377624)
24. Whyte D, Kranakis E, Van Oorschot P (2005) ARP-based detection of scanning worms within an enterprise network. In: Proc of annual computer security applications conference (ACSAC 2005), Tucson, AZ, 5-9 Dec 2005
25. Yasami Y, Farahmand M, Zargari V (2007) An ARP-based anomaly detection algorithm using hidden Markov model in enterprise networks. In: Proc of second international conference on systems and networks communication (ICSNC'07), August 2007, p 69
26. Yasami Y, Pourmozaffari S, Khorsandi S (2009) A stochastic learning automata-based algorithm for ARP anomaly detection in local area networks, CSI J Comput Sci Eng (submitted)
27. N Ye SM Emran Q Chen S Vilbert 2002 Multivariate statistical analysis of audit trails for host-based intrusion detection IEEE Trans Comput 51 7 810 820 10.1109/TC.2002.1017701 (Pubitemid 34835448)
28. N Ye Y Zhang CM Borror 2004 Robustness of the Markov-chain model for cyber-attack detection IEEE Trans Reliab 53 1 116 123 10.1109/TR.2004.823851
29. Yeung DY, Chow C (2002) Parzen-window network intrusion detectors. In: Proc of 16th int'l conf pattern recognition, Aug 2002, vol 4, pp 385-388
30. Zhang Z, Li J, Manikopoulos CN, Jorgenson J, Ucles J (2001) HIDE: a hierarchical network intrusion detection system using statistical preprocessing and neural network classification. In: Proc 2001 IEEE workshop information assurance, June 2001, pp 85-90