Unsupervised anomaly detection based on clustering and multiple one-class SVM

IEICE Transactions on Communications

Volumn E92-B, Issue 6, 2009, Pages 1981-1990

  Song, Jungsuk ^a,d   Takakura, Hiroki ^b   Okabe, Yasuo ^b   Kwon, Yongjin ^c  

^a KYOTO UNIVERSITY   (Japan)

^b KYOTO UNIVERSITY   (Japan)

^c Hankuk Aviation University   (South Korea)

^d NATIONAL INSTITUTE OF INFORMATION AND COMMUNICATIONS TECHNOLOGY   (Japan)

Author keywords

Anomaly detection; Clustering; Intrusion detection system; One class SVM

Indexed keywords

COMPUTER CRIME; MERCURY (METAL); NETWORK SECURITY; SUPPORT VECTOR MACHINES;

ANOMALY DETECTION; ANOMALY DETECTION METHODS; CLUSTERING; INTRUSION DETECTION MODELS; INTRUSION DETECTION SYSTEMS; ONE CLASS-SVM; ONE-CLASS SUPPORT VECTOR MACHINE; UNSUPERVISED ANOMALY DETECTION;

INTRUSION DETECTION;

EID: 77956590229     PISSN: 09168516     EISSN: 17451345     Source Type: Journal    
DOI: 10.1587/transcom.E92.B.1981     Document Type: Article

References (33)

1. D. E. Denning, "An intrusion detection model, " IEEE Trans. Softw. Eng., vol. SE-13, no. 2, pp. 222-232, 1987.
2. R. Bace and P. Mell, "Intrusion detection systems, " NIST Special Publications SP 800-31, Nov. 2001.
3. J. Allen, A. Christie, and W. Fithen, "State of the practice of intrusion detection technologies, " Technical Report, CMU/SEI-99-TR-028, 2000.
4. http://www.snort.org
5. http://www.bro-ids.org
6. M. M. Sebring, E. Shellhouse, M. E. Hanna, and R. Alan Whitehurst, "Expert systems in intrusion detection: A case study, " Proc. 11th National Computer Security Conference, pp. 74-81, Baltimore, Maryland, Oct. 1988.
7. J. Song, H. Ohba, H. Takakura, Y. Okabe, K. Ohira, and Y. Kwon, "A comprehensive approach to detect unknown attacks via intrusion detection alerts, " ASIAN2007 Focusing on Computer and Network Security, LNCS 4846, pp. 247-253, Doha Qatar, Dec. 2007.
8. J. Song, K. Ohira, H. Takakura, Y. Okabe and Y. Kwon, "A clustering method for improving performance of anomaly-based intrusion detection system, " IEICE Trans. Inf. & Syst., vol. E91-D, no. 5, pp. 1282-1291, May 2008.
9. Y. Bouzida and F. Cuppens, "Neural networks vs. decision trees for intrusion detection, " IEEE/IST Workshop on Monitoring, Attack Detection and Mitigation (MonAM 2006), 2006.
10. B. Schölkopf, J. Platt, J. Shawe-Taylor, A. Smola, and R. Williamson, "Estimating the support of a high-dimensional distribution, " Neural Comput., vol. 13, no. 7, pp. 1443-1471, 2001.
11. K. L. Li, H. K. Huang, S. F. Tian, and W. Xu, "Improving one-class SVM for anomaly detection, " International Conference on Machine Learning and Cybernetics, vol. 5, pp. 3077-3081, 2003.
12. H. Lee, J. Song, and D. Park, "Intrusion detection system based on multi-class SVM, " Rough Sets, Fuzzy Sets, Data Mining, and Granular Computing (RSFDGrC 2005), LNAI 3642, pp. 511-519, 2005.
13. E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo, "A geometric framework for unsupervised anomaly detection: Intrusion detection in unlabeled data, " Applications of Data Mining in Computer Security, 2002.
14. Y. Guan, A. Ghorbani, and N. Belacel, "Y-means: A clustering method for intrusion detection, " IEEE Canadian Conference on Electrical and Computer Engineering, Proc., 2003.
15. K. Leung and C. Leckie, "Unsupervised anomaly detection in network intrusion detection using clusters, " ACSC2005, 2005.
16. N. Cristianini and J. Shawe-Taylor, An Introduction to Support Vector Machines, Cambridge University Press, 2000.
17. E. Osuna, R. Freund, and F. Girosi, "Training support vector machines: An application to face detection, " International Conference on Computer Vision and Pattern Recognition (CVPR97), pp. 130-136, 1997.
18. S. Dumais, J. Platt, D. Heckerman, and M. Sahami, "Inductive learning algorithms and representations for text categorization, " 7th International Conference on Information and Knowledge Management, ACM-CIKM98, pp. 148-155, 1998.
19. J. Song, H. Takakura, and Y. Kwon, "A generalized feature extraction scheme to detect 0-day attacks via IDS alerts, " 2008 International Symposium on Applications and the Internet (SAINT2008), July-Aug. 2008.
20. The third international knowledge discovery and data mining tools competition dataset KDD99-Cup http://kdd.ics.uci.edu/databases/kddcup99/ kddcup99.html, 1999.
21. W. H. Chen, S. H. Hsu, and H. P. Shen, "Application of SVM and ANN for intrusion detection, " Computers & Operations Research, vol. 32, no. 10, pp. 2617-2634, 2005.
22. J. T. Yao, S. L. Zhao, and L. Fan, "An enhanced support vector machine model for intrusion detection, " LNAI4062, pp. 538-543, 2006.
23. T. Ambwani, "Multi class support vector machine implementation to intrusion detection, " Proc. International Joint Conference on Neural Networks, vol. 3, pp. 2300-2305, 2003.
24. X. Xu, "Adaptive intrusion detection based on machine learning: Feature extraction, classifier construction and sequential pattern prediction, " Int. J. Web Services Practices, vol. 2, no. 1-2 pp. 49-58, 2006.
25. Results of the KDD'99 Classifier Learning Contest, Available in http://wwwcse.ucsd.edu/users/elkan/clresults.html
26. W. Lee, S. J. Stolfo, and K. W. Mok, "A data mining framework for building intrusion detection models, " Proc. 1999 IEEE Symposium on Security and Privacy, pp. 120-132, 1999.
27. H. G. Kayacik, A. N. Zincir-Heywood, and M. I. Heywood, "On the capability of an SOM based intrusion detection system, " Proc. International Joint Conference on Neural Networks, vol. 3, pp. 1808-1813, 2003.
28. J. Song, H. Takakura, Y. Okabe, and Y. Kwon, "A robust feature normalization scheme and an optimized clustering method for anomaly-based intrusion detection system, " Proc. 12th International Conference on Database Systems for Advanced Applications (DASFAA 2007), LNCS 4443, pp. 140-151, 2007.
29. J. Song, H. Takakura, and Y. Okabe, "Cooperation of intelligent hon-eypots to detect unknown malicious codes, " WOMBAT Workshop on Information Security Threat Data Exchange (WISTDE 2008), April 2008.
30. K. Julisch, "Clustering intrusion detection alarms to support root cause analysis, " ACM Trans. Information and System Security, vol. 6, no. 4, pp. 443-471, 2003.
31. R. Sadoddin and A. A. Ghorbani, "A comparative study of unsupervised machine learning and data mining techniques for intrusion detection, " MLDM 2007, LNAI 4571, pp. 404-418, 2007.
32. S. Mukkamala and A. H. Sung., "Identifying significant features for network forensic analysis using artificial intelligent techniques, " Int. J. Digital Evidence, vol. 1, no. 4, 2003.
33. http://www.takakura.com/Kyoto-data