Unsupervised Network Intrusion Detection Systems: Detecting the Unknown without Knowledge

Computer Communications

Volumn 35, Issue 7, 2012, Pages 772-783

  Casas, Pedro ^a,b   Mazel, Johan ^a,b   Owezarski, Philippe ^a,b  

^a LAAS CNRS   (France)

^b UNIVERSITÉ DE TOULOUSE   (France)

Author keywords

Evidence Accumulation; NIDS; Outliers detection; Sub Space Clustering; Unsupervised Machine Learning

Indexed keywords

EVIDENCE ACCUMULATION; NIDS; OUTLIERS DETECTION; SUB-SPACES; UNSUPERVISED MACHINE LEARNING;

DATA PROCESSING; INTRUSION DETECTION; STATISTICS;

COMPUTER CRIME;

EID: 84858698273     PISSN: 01403664     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comcom.2012.01.016     Document Type: Conference Paper

References (29)

1. S. Hansman, R. Hunt, A taxonomy of network and computer attacks, in: Computers and Security, vol. 24, no. 1, pp. 31-43, 2005. (Pubitemid 40415398)
2. Symantec Enterprise Security, Symantec internet security threat report, Trends for 2010, Symantec reports, vol. 16, 2011.
3. N. Wyler Aggressive Network Self-Defense 2005 Syngress-Elsevier ISBN 978-1-931836-20-3
4. G. Cormode, S. Muthukrishnan, What is new: finding significant differences in network data streams, in: IEEE Transactions on Networking, vol. 13 no. 6, 2005, pp. 1219-1232. (Pubitemid 43034131)
5. P. Casas, J. Mazel, P. Owezarski, UNADA: Unsupervised network anomaly detection using sub-space outliers ranking, in: IFIP Networking, 2011.
6. G. Androulidakis, V. Chatzigiannakis, and S. Papavassiliou Network anomaly detection and classification via opportunistic sampling IEEE Network 23 1 2009
7. R. Kemmerer, and G. Vigna Intrusion detection: a brief history and overview IEEE Security & Privacy Magazine 35 4 2002
8. A. Sperotto, G. Schaffrath, R. Sadre, C. Morariu, A. Pras, and B. Stiller An Overview of IP Flow-Based Intrusion Detection IEEE Communications Surveys & Tutorials 12 3 2010
9. C. Kruegel, T. Toth, Using decision trees to improve signature-based intrusion detection, in: Proceedings RAID, 2003.
10. J. Lee, H. Lee, S. Sohn, J. Ryu, T. Chung, Effective value of decision tree with KDD99 intrusion detection datasets for IDS, in: Proceedings ICACT, 2008.
11. A. Lakhina, M. Crovella, C. Diot, Characterization of network-wide anomalies in traffic flows, in: Proceedings ACM IMC, 2004.
12. A. Lakhina, M. Crovella, C. Diot, Diagnosing network-wide traffic anomalies, in: Proceedings ACM SIGCOMM, 2004.
13. A. Lakhina, M. Crovella, C. Diot, Mining anomalies using traffic feature distributions, in: Proceedings ACM SIGCOMM, 2005.
14. D. Brauckhoff, K. Salamatian, M. May, Applying PCA for traffic anomaly detection: problems and solutions, in: Proceedings IEEE INFOCOM, 2009.
15. H. Ringberg, A. Soule, J. Rexford, C. Diot, Sensitivity of PCA for traffic anomaly detection, in: Proceedings ACM SIGMETRICS, 2007.
16. G. Dewaele, K. Fukuda, P. Borgnat, P. Abry, K. Cho, Extracting hidden anomalies using sketch and non gaussian multi-resolution statistical detection procedures, in: Proceedings ACM LSAD Workshop, 2007.
17. A.K. Jain Data clustering: 50 years beyond K-means Pattern Recognition Letters 31 8 2010 651 666
18. L. Parsons, E. Haque, and H. Liu Subspace clustering for high dimensional data: a review ACM SIGKDD Expl. Newsletter 6 1 2004 90 105
19. L. Portnoy, E. Eskin, S. Stolfo, Intrusion detection with unlabeled data using clustering, in: Proceedings ACM DMSA Workshop, 2001.
20. E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo A geometric framework for unsupervised anomaly detection: detecting intrusions in unlabeled data Applications of Data Mining in Computer Security 2002 Kluwer Publisher
21. K. Leung, C. Leckie, Unsupervised Anomaly detection in network intrusion detection using clustering, in: Proceedings ACSC, 2005.
22. A. Fred, and A.K. Jain Combining multiple clusterings using evidence accumulation IEEE Transactions on Pattern Analysis and Machine Intelligence 27 6 2005
23. M. Ester, P. Kriegel, J. Sander, X. Xu, A density-based algorithm for discovering clusters in large spatial databases with noise, in: Proceedings ACM SIGKDD, 1996.
24. G. Fernandes, P. Owezarski, Automated classification of network traffic anomalies, in: Proceedings SecureComm, 2009.
25. K. Cho, K. Mitsuya, A. Kato, Traffic data repository at the WIDE Project, in: USENIX Annual Technical Conference, 2000.
26. The KDD Cup 1999 Dataset, at .
27. METROlogy for SECurity and QoS, at .
28. Bro intrusion detection system, at .
29. SNORT: an Open source network intrusion prevention and detection system, at .