Unsupervised anomaly intrusion detection via localized Bayesian feature selection

Proceedings - IEEE International Conference on Data Mining, ICDM

Volumn , Issue , 2011, Pages 1032-1037

  Fan, Wentao ^a   Bouguila, Nizar ^b   Ziou, Djemel ^c  

^a Civil and Environmental Engineering   (Canada)

^b University of Concordia   (Canada)

^c UNIVERSITÉ DE SHERBROOKE   (Canada)

Author keywords

Anomaly detection; Feature selection; Generalized Dirichlet; Mixture models; Model selection; Variational inference

Indexed keywords

ANOMALY DETECTION; DIRICHLET; MIXTURE MODELS; MODEL SELECTION; VARIATIONAL INFERENCE;

DATA MINING; FEATURE EXTRACTION; INTRUSION DETECTION;

COMPUTER CRIME;

EID: 84857153518     PISSN: 15504786     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICDM.2011.152     Document Type: Conference Paper

References (28)

1. S. Northcutt and J. Novak, Network Intrusion Detection: An Analyst's Handbook. New Riders Publishing, 2002.
2. C. Krügel, T. Toth, and E. Kirda, "Service specific anomaly detection for network intrusion detection," in Proc. of the ACM symposium on Applied computing (SAC), 2002, pp. 201-208.
3. R. Lippmann, J. W. Haines, D. J. Fried, J. Korba, and K. Das, "Analysis and results of the 1999 darpa off-line intrusion detection evaluation," in Recent Advances in Intrusion Detection, 2000, pp. 162-182.
4. J. McHugh, A. Christie, and J. Allen, "Defending yourself: The role of intrusion detection systems," IEEE Software, vol. 17, no. 5, pp. 42-51, 2000.
5. R. Perdisci, G. Gu, and W. Lee, "Using an ensemble of oneclass svm classifiers to harden payload-based anomaly detection systems," in Proc. of the IEEE International Conference on Data Mining (ICDM), 2006, pp. 488-498.
6. D. E. Denning, "An intrusion detection model," IEEE Transactions on Software Engineering, vol. 13, no. 2, pp. 222-232, 1987.
7. W. Lee, S. J. Stolfo and P. K. Chan, "Learning patterns from unix process execution traces for intrusion detection," in Proc. AAAI Workshop on AI Approaches to Fraud Detection and Risk Management, 1997, pp. 50-56.
8. L. Portnoy, E. Eskin, and S. Stolfo, "Intrusion detection with unlabeled data using clustering," in Proc. of ACM CSS Workshop on Data Mining Applied to Security (DMSA), 2001, pp. 5-8.
9. E. Eskin, A. Arnold, M. Prerau, L. Portnoy and S. Stolfo, "A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data," in Applications of Data Mining in Computer Security, D. Barbara and S. Jajodia, Eds. Kluwer, 2002, pp. 77-99.
10. K. Wang and S. J. Stolfo, "Anomalous payload-based network intrusion detection," in RAID, 2004, pp. 203-222.
11. A. K. Ghosh and A. Schwartzbard, "A study in using neural networks for anomaly and misuse detection," in Proc. of the 8th conference on USENIX Security Symposium - Volume 8, 1999, pp. 12-12.
12. W. Fan, M. Miller, S. J. Stolfo, W. Lee and P. K. Chan, "Using artificial anomalies to detect unknown and known network intrusions," in Proc. of the IEEE International Conference on Data Mining (ICDM), 2001, pp. 123-130.
13. C. Warrender, S. Forrest and B. Pearlmutter, "Detecting intrusions using system calls: Alternative data models," in Proc. of the IEEE Symposium on Security and Privacy, 1999, pp. 133-145.
14. E. Eskin, "Anomaly detection over noisy data using learned probability distributions," in Proc. of the IEEE International Conference on Machine Learning (ICML), 2000, pp. 255-262.
15. E. Eskin, W. Lee and S. J. Stolfo, "Modeling system calls for intrusion detection with dynamic window sizes," in Proc. of DARPA Information Survivabilty Conference and Exposition (DISCEX), 2001, pp. 165-175.
16. N. Ye, X. Li, Q. Chen, S. M. Erman and M. Xu, "Probabilistic techniques for intrusion detection based on computer audit data," IEEE Transactions on Systems, Man, and Cybernetics- Part A, vol. 31, no. 4, pp. 266-274, 2001.
17. W. DuMouchel and M. Schonlau, "A fast computer intrusion detection algorithm based on hypothesis testing of command transition probabilities," in Proc. of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 1998, pp. 189-193.
18. W. Lee and D. Xiang, "Information-theoretic measures for anomaly detection," in Proc. of the IEEE Symposium on Security and Privacy, 2001, pp. 130-143.
19. G. Gacinto, F. Roli and L. Didaci, "Fusion of multiple classifiers for intrusion detection in computer networks," Pattern Recognition Letters, vol. 24, pp. 1795-1803, 2003.
20. Y. Li and L. Guo, "Tcm-knn scheme for network anomaly detection using feature-based optimizations," in Proc. of the ACM symposium on Applied computing (SAC), 2008, pp. 2103-2109.
21. G.J. McLachlan and D. Peel, Finite Mixture Models. New York: Wiley, 2000.
22. S. Boutemedjet, N. Bouguila, and D. Ziou, "A hybrid feature extraction selection approach for high-dimensional nongaussian data clustering," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 31, no. 9, pp. 1429-1443, 2009.
23. P. Helman and J. Bhangoo, "A statistically based system for prioritizing information exploration under uncertainity," IEEE Transactions on Systems, Man, and Cybernetics - Part A, vol. 27, no. 4, pp. 449-466, 1997.
24. M. H. C. Law, M. A. T. Figueiredo, and A. K. Jain, "Simultaneous feature selection and clustering using mixture models," IEEE Trans. Pattern Anal. Mach. Intell, pp. 1154-1166, 2004.
25. Y. Li, M. dong, and J. Hua, "Simultaneous localized feature selection and model detection for gaussian mixtures," IEEE Trans. Pattern Anal. Mach. Intell., vol. 31, pp. 953-960, May 2009.
26. Z. Ma and A. Leijon, "Bayesian estimation of beta mixture models with variational inference," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 33, no. 7, 2011.
27. T. S. Jaakkola and M. I. Jordan, "Bayesian parameter estimation via variational methods," Statistics and Computing, vol. 10, pp. 25-37, January 2000.
28. C. Constantinopoulos, M. K. Titsias, and A. Likas, "Bayesian feature and model selection for gaussian mixture models," IEEE Trans. Pattern Anal. Mach. Intell., vol. 28, pp. 1013-1018, June 2006.