Neural visualization of network traffic data for intrusion detection

Applied Soft Computing Journal

Volumn 11, Issue 2, 2011, Pages 2042-2056

  Corchado, Emilio ^a   Herrero, Álvaro ^b  

^a UNIVERSITY OF SALAMANCA   (Spain)

^b UNIVERSITY OF BURGOS   (Spain)

Author keywords

Computer network security; Connectionist unsupervised models; Intrusion detection; Network traffic visualization; Neural and exploratory projection techniques

Indexed keywords

CONNECTIONIST UNSUPERVISED MODELS; DATA SETS; FOURTH ORDER STATISTICS; INTERNAL STRUCTURE; INTRUSION DETECTION SYSTEMS; MOBILE VISUALIZATION; NETWORK ADMINISTRATOR; NETWORK TRAFFIC; NETWORK TRAFFIC VISUALIZATION; NOVEL TESTING; NUMERICAL DATASETS; PROJECTION TECHNIQUES; TEMPORAL DIMENSIONS; TRAFFIC DATA; VISUAL INFORMATION;

COMPUTER ARCHITECTURE; COMPUTER CRIME; DATA VISUALIZATION; INTERFACES (COMPUTER); INTERNET; MOBILE DEVICES; NETWORK SECURITY; NEURAL NETWORKS; TESTING; VISUALIZATION;

INTRUSION DETECTION;

EID: 78751621903     PISSN: 15684946     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.asoc.2010.07.002     Document Type: Conference Paper

References (77)

1. J.M. Myerson Identifying enterprise network vulnerabilities International Journal of Network Management 12 2002 135 144
2. A. Abraham, C. Grosan, and C. Martin-Vide Evolutionary design of intrusion detection programs International Journal of Network Security 4 2007 328 339
3. W. Lu, and I. Traore Detecting new forms of network intrusion using genetic programming Computational Intelligence 20 2004 475 494
4. K. Julisch Data mining for intrusion detection: a critical review D. Barbará, S. Jajodia, Applications of Data Mining in Computer Security 2002 Kluwer Academic Publishers 33 62
5. W. Lee, and S.J. Stolfo A framework for constructing features and models for intrusion detection systems ACM Transactions on Information and System Security (TISSEC) 2000 227 261
6. Y.H. Liao, and V.R. Vemuri Use of K-nearest neighbor classifier for intrusion detection Computers and Security 21 2002 439 448
7. W. Lee, S.J. Stolfo, and K.W. Mok Adaptive intrusion detection: a data mining approach Artificial Intelligence Review 14 2000 533 567
8. G. Giacinto, F. Roli, and L. Didaci Fusion of multiple classifiers for intrusion detection in computer networks Pattern Recognition Letters 24 2003 1795 1803
9. S. Chebrolu, A. Abraham, and J.P. Thomas Feature deduction and ensemble design of intrusion detection systems Computers and Security 24 2005 295 307
10. L. Cohen, G. Avrahami, M. Last, and A. Kandel Info-fuzzy algorithms for mining dynamic data streams Applied Soft Computing 8 2008 1283 1294
11. D.E. Denning An intrusion-detection model IEEE Transactions on Software Engineering 13 1987 222 232
12. T.F. Lunt IDES: an intelligent system for detecting intruders Symposium: Computer Security, Threat and Countermeasures 1990
13. A. Tajbakhsh, M. Rahmati, and A. Mirzaei Intrusion detection using fuzzy association rules Applied Soft Computing 9 2009 462 469
14. A. Abraham, R. Jain, J. Thomas, and S.Y. Han D-SCIDS: distributed soft computing intrusion detection system Journal of Network and Computer Applications 30 2007 81 98
15. S. Zanero, and S. Savaresi Unsupervised learning techniques for an intrusion detection system ACM Symposium on Applied Computing 2004 412 419
16. E. Corchado, Á. Herrero, and J.M. Sáiz Detecting compounded anomalous SNMP situations using cooperative unsupervised pattern recognition 15th International Conference on Artificial Neural Networks (ICANN 2005) 2005 905 910
17. Á. Herrero, E. Corchado, and J.M. Sáiz An unsupervised cooperative pattern recognition model to identify anomalous massive SNMP data sending ICNC05 2005 778 782
18. S.T. Sarasamma, Q.M.A. Zhu, and J. Huff Hierarchical Kohonenen net for anomaly detection in network security IEEE Transactions on Systems Man and Cybernetics, Part B 35 2005 302 312
19. S. Mukkamala, and A.H. Sung Feature selection for intrusion detection using neural networks and support vector machines Transportation Security and Infrastructure Protection 2003 33 39
20. C. Zhang, J. Jiang, and M. Kamel Intrusion detection using hierarchical neural networks Pattern Recognition Letters 26 2005 779 791
21. D.J. Marchette Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint 2001 Springer-Verlag, Inc. New York
22. M. Roesch Snort-lightweight intrusion detection for networks 13th Systems Administration Conference (LISA '99) 1999 229 238
23. T. Goldring Scatter (and other) plots for visualizing user profiling data and network traffic 2004 ACM Workshop on Visualization and Data Mining for Computer Security Washington, DC, USA 2004 119 123
24. C. Muelder, K.L. Ma, and T. Bartoletti Interactive Visualization for Network and Port Scan Detection Nineth International Symposium on Recent Advances in Intrusion Detection (RAID 2006) 2006 265 283
25. A. Kulsoom, C. Lee, G. Conti, and J.A. Copeland Visualizing network data for intrusion detection Sixth Annual IEEE Information Assurance Workshop - Systems, Man and Cybernetics (SMC) 2005 100 108
26. MRTG: The Multi Router Traffic Grapher. http://www.mrtg.org.
27. K. Labib, and V.R. Vemuri An application of principal component analysis to the detection and visualization of computer network attacks Annals of Telecommunications 61 2006 218 234
28. A. Komlodi, P. Rheingans, A. Utkarsha, J.R. Goodall, and J. Amit A user-centered look at glyph-based security visualization IEEE Workshop on Visualization for Computer Security (VizSEC 05) 2005 21 28
29. R.A. Becker, S.G. Eick, and A.R. Wilks Visualizing network data IEEE Transactions on Visualization and Computer Graphics 1 1995 16 28
30. H. Koike, K. Ohno, and K. Koizumi Visualizing cyber attacks using IP matrix IEEE Workshop on Visualization for Computer Security (VizSEC 05) 2005 91 98
31. J.R. Goodall, W.G. Lutters, P. Rheingans, and A. Komlodi Preserving the big picture: visual network traffic analysis with TNV IEEE Workshop on Visualization for Computer Security (VizSEC 05) 2005 47 54
32. A. Oline, and D. Reiners Exploring three-dimensional visualization for intrusion detection IEEE Workshop on Visualization for Computer Security (VizSEC 05) 2005 113 120
33. P. Ren, Y. Gao, Z.C. Li, Y. Chen, and B. Watson IDGraphs: intrusion detection and analysis using stream compositing IEEE Computer Graphics and Applications 26 2006 28 39
34. L. Girardin An eye on network intruder-administrator shootouts 1st Workshop on Intrusion Detection and Network Monitoring Santa Clara, CA, USA 1999
35. C. Ahlberg, and B. Shneiderman Visual information seeking: tight coupling of dynamic query filters with starfield displays Readings in Information Visualization: Using Vision to Think 1999 Morgan Kaufmann Publishers, Inc. pp. 244-250
36. K. Lakkaraju, W. Yurcik, and A.J. Lee NVisionIP: netflow visualizations of system state for security situational awareness 2004 ACM Workshop on Visualization and Data Mining for Computer Security Washington, DC, USA 2004 65 72
37. S.T. Teoh, K.L. Ma, S.F. Wu, and X. Zhao Case study: interactive visualization for internet security IEEE Conference on Visualization (Vis 2002) Boston, MA, USA 2002
38. K. Nyarko, T. Capers, C. Scott, and K.A. Ladeji-Osias Network intrusion visualization with NIVA, an intrusion detection visual analyzer with haptic integration 10th Symposium on Haptic Interfaces for Virtual Environment and Teleoperator Systems (HAPTICS 2002) 2002 277 284
39. P. Ren, Y. Gao, Z.C. Li, Y. Chen, and B. Watson IDGraphs: intrusion detection and analysis using histographs IEEE Workshop on Visualization for Computer Security (VizSEC 05) 2005 39 46
40. H. Koike, and K. Ohno SnortView: visualization system of snort logs 2004 ACM Workshop on Visualization and Data Mining for Computer Security Washington, DC, USA 2004 143 147
41. K. Abdullah, C.P. Lee, G. Conti, J.A. Copeland, and J. Stasko IDS RainStorm: visualizing IDS alarms IEEE Workshop on Visualization for Computer Security (VizSEC 05) 2005 1 10
42. A.D. D'Amico, J.R. Goodall, D.R. Tesone, and J.K. Kopylec Visual discovery in computer network defense IEEE Computer Graphics and Applications 27 2007 20 27
43. A. Chuvakin Monitoring IDS Information Security Journal: A Global Perspective 12 2004 12 16
44. J.H. Friedman, and J.W. Tukey A projection pursuit algorithm for exploratory data-analysis IEEE Transactions on Computers 23 1974 881 890
45. P. Diaconis, and D. Freedman Asymptotics of graphical projection pursuit The Annals of Statistics 12 1984 793 815
46. R.F. Erbacher Visual traffic monitoring and evaluation Conference on Internet Performance and Control of Network Systems II 2001 153 160
47. F. Mansmann, D.A. Keim, S.C. North, B. Rexroad, and D. Sheleheda Visual analysis of network traffic for resource planning, interactive monitoring, and interpretation of security threats IEEE Transactions on Visualization and Computer Graphics 13 2007 1105 1112
48. K. Stockinger, E.W. Bethel, S. Campbell, E. Dart, and K. Wu Detecting distributed scans using high-performance query-driven visualization 2006 ACM/IEEE Conference on Supercomputing Tampa, FL, USA 2006
49. T. Kohonen The self-organizing map IEEE 78 1990 1464 1480
50. H. Hotelling Analysis of a complex of statistical variables into principal components Journal of Education Psychology 24 1933 417 444
51. K. Pearson On lines and planes of closest fit to systems of points in space Philosophical Magazine 2 1901 559 572
52. X. Jianqiang, J.E. Dickerson, and J.A. Dickerson Fuzzy feature extraction and visualization for intrusion detection 12th IEEE International Conference on Fuzzy Systems 2003 1249 1254
53. N. Elmqvist, P. Dragicevic, and J.D. Fekete Rolling the dice: multidimensional visual exploration using scatterplot matrix navigation IEEE Transactions on Visualization and Computer Graphics 14 2008 1148 1539
54. E. Oja A simplified neuron model as a principal component analyzer Journal of Mathematical Biology 15 1982 267 273
55. D. Sanger Contribution analysis: a technique for assigning responsibilities to hidden units in connectionist networks Connection Science 1 1989 115 138
56. C. Fyfe A neural network for PCA and beyond Neural Processing Letters 6 1997 33 41
57. E. Corchado, D. MacDonald, and C. Fyfe Maximum and minimum likelihood Hebbian learning for exploratory projection pursuit Data Mining and Knowledge Discovery 8 2004 203 225
58. E. Corchado, and C. Fyfe Connectionist techniques for the identification and suppression of interfering underlying factors International Journal of Pattern Recognition and Artificial Intelligence 17 2003 1447 1466
59. C. Fyfe, and E. Corchado Maximum likelihood Hebbian rules 10th European Symposium on Artificial Neural Networks (ESANN 2002) 2002 143 148
60. E. Corchado, Y. Han, and C. Fyfe Structuring global responses of local filters using lateral connections Journal of Experimental and Theoretical Artificial Intelligence 15 2003 473 487
61. H.S. Seung, N.D. Socci, and D. Lee The rectified Gaussian distribution Advances in Neural Information Processing Systems 10 1998 350 356
62. E. Corchado, P. Burgos, M.D. Rodriguez, and V. Tricio A hierarchical visualization tool to analyse the thermal evolution of construction materials CDVE 2004 2004 238 245
63. E. Corchado, M.A. Pellicer, and M.L. Borrajo A maximum likelihood Hebbian learning-based method to an agent-based architecture International Journal of Computer Mathematics 86 2009 1760 1768
64. Á. Herrero, E. Corchado, L. Sáiz, and A. Abraham DIPKIP: a connectionist knowledge management system to identify knowledge deficits in practical cases Computational Intelligence 26 2010 26 56
65. H. Ritter, T. Martinetz, and K. Schulten Neural Computation and Self-Organizing Maps; An Introduction 1992 Addison-Wesley Longman Publishing Co., Inc.
66. P. Demartines, and J. Herault Curvilinear component analysis: a self-organizing neural network for nonlinear mapping of data sets IEEE Transactions on Neural Networks 8 1997 148 154
67. Cisco IOS NetFlow. http://www.cisco.com/web/go/netflow.
68. J. Case, M.S. Fedor, M.L. Schoffstall, and C. Davin Simple network management protocol (SNMP) IETF RFC 1157 1990
69. Vulnerability Statistics Report 2000 Cisco Secure Consulting
70. S. Institute The Top 10 Most Critical Internet Security Threats (2000-2001 Archive) 2001
71. S. Northcutt, M. Cooper, K. Fredericks, M. Fearnow, and J. Riley Intrusion Signatures and Analysis 2001 New Riders Publishing Thousand Oaks
72. DARPA Intrusion Detection Evaluation. http://www.ll.mit.edu/mission/ communications/ist/corpora/ideval/index.html.
73. M.V. Mahoney, and P.K. Chan An analysis of the 1999 DARPA/Lincoln laboratory evaluation data for network anomaly detection Sixth International Symposium on Recent Advances in Intrusion Detection (RAID 2003) 2003 220 237
74. J. McHugh Testing intrusion detection systems: a critique of the 1998 and 1999 Darpa off-line intrusion detection system evaluation as performed by Lincoln laboratory ACM Transactions on Information and System Security 3 2000 262 294
75. M.J. Ranum Experiences Benchmarking Intrusion Detection Systems 2001 NFR Security Technical Publications
76. G. Vigna, W. Robertson, and D. Balzarotti Testing network-based intrusion detection signatures using mutant exploits 11th ACM Conference on Computer and Communications Security Washington, DC, USA 2004 21 30
77. R. Marti, THOR: a tool to test intrusion detection systems by variations of attacks, Diploma Thesis, ETH Zurich, 2002.