MLH-IDS: A multi-level hybrid intrusion detection method

Computer Journal

Volumn 57, Issue 4, 2014, Pages 602-623

  Gogoi, Prasanta ^a   Bhattacharyya, D K ^a   Borah, B ^a   Kalita, Jugal K ^b  

^a TEZPUR UNIVERSITY   (India)

^b University of Colorado at Colorado Springs   (United States)

Author keywords

features; IDS; multi level; outlier; supervised; unsupervised

Indexed keywords

COMPUTER NETWORKS; DATA MINING; ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS; STATISTICS;

FEATURES; IDS; MULTI-LEVEL; OUTLIER; SUPERVISED; UNSUPERVISED;

INTRUSION DETECTION;

EID: 84897433175     PISSN: 00104620     EISSN: 14602067     Source Type: Journal    
DOI: 10.1093/comjnl/bxt044     Document Type: Article

References (72)

1. Bace, R. and Mell, P. (2001) Intrusion Detection Systems. NIST Special Publications SP 800, U S Department of Defence, 31 November 2001
2. Lee, W. and Stolfo, S.J. (1998) Data Mining Approaches for Intrusion Detection. Proc. 7th Conf. USENIX Security Symp., Vol. 7, San Antonio, TX, USA, January, pp. 6-6. USENIX
3. Roesch, M. (1999) Snort-Lightweight Intrusion Detection for Networks. Proc. 13th USENIX Conf. System Administration, Seattle,WA, USA, November, pp. 229-238. USENIX
4. Portnoy, L., Eskin, E. and Stolfo, S.J. (2001) Intrusion Detection with Unlabeled Data Using Clustering. Proc.ACMCSSWorkshop DMSA-2001, Philadelphia PA, USA, November 8, pp. 5-8.ACM
5. Zhang, C., Zhang, G. and Sun, S. (2009) A Mixed Unsupervised Clustering-Based Intrusion Detection. Proc. 3rd Int. Conf. Genetic and Evolutionary Computing, WGEC 2009, Gulin, China, October 14-17. IEEE Computer Society
6. Kumar, S., Kumar, S. and Nandi, S. (2011) Multi-Density Clustering Algorithm for Anomaly Detection Using KDD?99 Dataset. Proc. 1st Int. Conf. Advances in Computing and Communications (ACC 2011), Kochi, India, July 22-24, Communications in Computer and Information Science (CCIS) 190, pp. 619-630. Springer, Berlin
7. Gogoi, P., Bhattacharyya, D.K., Borah, B. and Kalita, J.K. (2011) A survey of outlier detection methods in network anomaly identification. Comput. J., 54, 570-588
8. Borah, B. and Bhattacharyya, D.K. (2008) Catsub: A technique for clustering categorical data based on subspace. ICFAI J. Comput. Sci., II, 7-20
9. Gogoi, P., Borah, B. and Bhattacharyya, D.K. (2011) Network anomaly detection using unsupervised model. Int. J. Comput. Appl. Spec. Issue Netw. Secur. Cryptogr., NSC(1), 19-30
10. Lippmann, R. et al. (2000) Evaluating Intrusion Detection Systems: The 1998 DARPA Off-Line Intrusion Detection Evaluation. Proc. DARPA Information Survivability Conf. and Exposition (DISCEX) 2000, Los Alamitos, CA, USA, pp. 12-26. IEEE Computer Society Press
11. Daniel, B., Julia, C., Sushil, J. and Ningning,W. (2001)ADAM: A testbed for exploring the use of data mining in intrusion detection. SIGMOD Rec., 30, 15-24
12. Burbeck, K. and Nadjm-Tehrani, S. (2005) ADWICE- Anomaly Detection with Real-Time Incremental Clustering. Proc. Information Security and Cryptology-ICISC 2004, Berlin, Germany, May, pp. 407-424. Springer, Berlin
13. Oke, G. and Loukas, G. (2007) A denial of service detector based on maximum likelihood detection and the random neural network. Comput. J., 50, 717-727
14. Garcia-Teodoro, P., Diaz-Verdejo, J., Macia-Fernandez, G. and Vazquez, E. (2009) Anomaly-based network intrusion detection: Techniques, systems and challenges. Comput. Secur., 28, 18-28
15. Sperotto, A., Schaffrath, G., Sadre, R., Morariu, C., Pras, A. and Stiller, B. (2010) An overview of IP flow-based intrusion detection. IEEE Commun. Surv. Tutor., 12, 343-356
16. Bhuyan, M.H., Bhattacharyya, D.K. and Kalita, J.K. (2011) Surveying port scans and their detection methodologies. Comput. J., 54, 1-17
17. Bhange, A. and Utareja, S. (2012) Anomaly detection and prevention in network traffic based on statistical approach and a- stable model. Int. J. Adv. Res. Comput. Eng. Technol., 1, 690-698
18. Chaturvedi, S.K., Richariya, V. and Tiwari, N. (2012) Anomaly detection in network using data mining techniques. Int. J. Emerging Technol. Adv. Eng., 2, 2250-2459
19. Zhang, T., Ramakrishnan, R. and Livny, M. (1996) Birch: An Efficient Data Clustering Method forVery Large Databases. Proc. 1996 ACM SIGMOD, Montreal, Quebec, Canada, June 4-6, pp. 103-114. ACM Press
20. Leung, K. and Leckie, C. (2005) Unsupervised Anomaly Detection in Network Intrusion Detection Using Clusters. Proc. 28th Australasian Conf. Computer Science, Vol. 38, Newcastle, NSW, Australia, January/February, pp. 333-342. Australian Computer Society, Inc. Darlinghurst
21. Casas, P., Mazel, J. and Owezarski, P. (2011) UNADA: Unsupervised Network Anomaly Detection Using Sub-Space Outliers Ranking. Proc. 10th Int. IFIP TC 6 Conf. Networking- Volume Part I (NETWORKING?11), Heidelberg, Germany, pp. 40-51. Springer, Berlin
22. Wang,W.,Yang, J. and Muntz, R.R. (1997) STING:A Statistical Information Grid Approach to Spatial Data Mining. In Proc. of 23rd Int. Conf. on Very Large Databases, San Francisco, CA, USA, pp. 186-195. Morgan Kaufmann
23. Nagesh, H.S., Goil, S. and Choudhary, A.N. (2000) A Scalable Parallel Subspace Clustering Algorithm for Massive Data Sets. Proc. ICPP 2000, Toronto, Canada, August 21-24, p. 477. IEEE Computer Society
24. Pan, Z.S., Chen, S.C., Hu, G.B. and Zhang, D.Q. (2003) Hybrid Neural Network and C4.5 for Misuse Detection. Proc. 2003 Int. Conf. Machine Learning and Cybernetics,Wan, pp. 2463-2467. IEEE Computer Society
25. Depren, O., Topllar, M., Anarim, E. and Ciliz, M.K. (2005) An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks. Expert Syst. Appl., 29, 713-722
26. Zhang, J. and Zulkernine, M. (2006)A Hybrid Network Intrusion Detection Technique Using Random Forests. Proc. 1st Int. Conf. Availability, Reliability and Security, ARES 2006, Vienna, Austria, pp. 262-269. IEEE Xplore
27. Hwang, K., Cai, M., Chen,Y. and Qin, M. (2007) Hybrid intrusion detection with weighted signature generation over anomalous internet episodes. IEEE Trans. Dependable Secur. Comput., 4, 41-55
28. Aydyn, M.A., Zaim, A.H. and Ceylan, K.G. (2009) A hybrid intrusion detection system design for computer network security. Comput. Electr. Eng., 35, 517-526
29. Xiang, C., Chong, M.Y. and Zhu, H.L. (2004) Design of Multiple- Level Tree Classifiers for Intrusion Detection System. Proc. 2004 IEEE Conf. Cybernetics and Intelligent Systems, Singapore, December, pp. 872-877. IEEE Xplore
30. Amini, M., Jalili, R. and Shahriari, H.R. (2006) RT-UNNID: A practical solution to real-Time network-based intrusion detection using unsupervised neural networks. Comput. Secur., 25, 459-468
31. Han, J. and Kamber, M. (2001) Data Mining: Concepts and Techniques. Morgan Kaufmann Publishers, San Francisco, CA.
32. Kayacik, H.G., Heywood, A.N.Z. and Heywood, M.I. (2005) Selecting Features for Intrusion Detection: A Feature Relevance Analysis on KDD 99 Intrusion Detection Datasets. Proc. 3rd Annual Conf. Privacy, Security and Trust, Halifax, NS, Canada, October. Dalhousie University
33. Dunn, J. (1974) Well separated clusters and optimal fuzzy partitions. J. Cybern., 4, 95-104
34. Huberi, L. and Schultz, J. (1976) Quadratic assignment as a general data analysis strategy. Br. J. Math. Stat. Psychol., 29, 190-241
35. Davies, D.L. and Bouldin, D.W. (1979) A cluster separation measure. IEEE Trans. Pattern Anal. Mach. Intell., PAMI 1, 224-227
36. Rousseeuw, P.J. (1987) Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. J. Comput. Appl. Math., 20, 53-65
37. Xie, X.L. and Beni, G. (1991) A validity measure for fuzzy clustering. IEEE Trans. Pattern Anal. Mach. Intell., 13, 841-847
38. Guo,Y. et al. (2010) Feature Selection Based on Rough Set and Modified Genetic Algorithm for Intrusion Detection. Proc. 5th Int. Conf. Computer Science &Education, Hefei, China, August 24-27, pp. 1441-1446. IEEEXplore
39. Jin, W., Tung, A.K.H., Han, J. and Wang, W. (2006) Ranking Outliers Using Symmetric Neighborhood Relationship. Proc. 10th Pacific-Asia Conf. Advances in Knowledge Discovery and Data Mining (PAKDD), Singapore, pp. 577-593
40. Katayama, N. and Satoh, S. (1997) The SR-Tree: An Index Structure for High-dimensional Nearest Neighbor Queries. Proc. 1997 ACM SIGMOD Int. Conf. Management of data, SIGMOD ?97, NY, USA, June. ACM, NewYork
41. Gogoi, P., Bhuyan, M.H., Bhattacharyya, D.K. and Kalita, J.K. (2012) Packet and Flow Based Network Intrusion Dataset. Proc. 5th Int. Conf. Contemporary Computing (IC3-2012), Noida, India, August 6-8, Communications in Computer and Information Science (CCIS) 306, pp. 322-334. Springer, Berlin
42. Hettich, S. and Bay, S.D. (1999) The UCI KDD archive. Irvine, CA: University of California, Department of Information and Computer Science. http://kdd.ics.uci.edu
43. Tavallaee, M., Bagheri, E., Lu, W. and Ghorbani, A.A. (2009) A detailed analysis of the KDD CUP 99 data set. http://nsl.cs.unb.ca/NSL-KDD/
44. Mixter, D. (2003) Attacks tools and information. http:// packetstormsecurity.nl/index.html
45. Satten, C. (2008) Lossless gigabit remote packet capture with Linux. University of Washington Network Systems. http://staff.washington.edu/corey/ gulp/
46. 2009). http://www.wireshark.org/
47. Quittek, J., Zseby, T., Claise, B. and Zender, S. (2004) Rfc 3917: Requirements for IP flow information export: IPFIX, Hawthorn Victoria. http://www.ietf.org/rfc/rfc3917.txt
48. Claise, B. (2004) Rfc 3954: Cisco Systems Netflow Services Export Version 9. http://www.ietf.org/rfc/rfc3954.txt
49. Cisco.com (2010) Cisco IOS NetFlow configuration guide, Release 12.4. http://www.cisco.com
50. Haag, P. (2010) Nfdump &Nfsen. http://nfdump.source forge.net/
51. Quinlan, J.R. (1993) C4.5:Programs for Machine Learning. Morgan Kaufman
52. Jesen, F.V. (1996) Introduction to Bayesian Networks. UCL Press
53. Langley, P., Iba, W. and Thomas, K. (1992) An Analysis of Bayesian Classifiers. Proc. 10th National Conf. Artificial Intelligence, San Jose, CA, USA, July 12-16, pp. 223-228.AAAI Press
54. University of Waikato (1999) Weka 3: Data Mining Software in Java. http://www.cs.waikato.ac.nz/ml/weka
55. Lu, H. and Xu, J. (2009) Three-Level Hybrid Intrusion Detection System. Proc. Int. Conf. Information Engineering and Computer Science, ICIECS 2009, Shanghai, China, December 19-20, pp. 1-4. IEEE
56. Xiang, C.,Yong, P.C. and Meng, L.S. (2008) Design of multiplelevel hybrid classifier for intrusion detection system using Bayesian clustering and decision trees. Pattern Recognit. Lett., 29, 918-924
57. Horng, S-J., Su, M-Y., Chen,Y-H., Kao, T-W., Chen, R-J., Lai, J-L. and Perkasa, C.D. (2011)Anovel intrusion detection system based on hierarchical clustering and support vector machines. Expert Syst. Appl., 38, 306-313
58. Dickerson, J.E. (2000) Fuzzy Network Profiling for Intrusion Detection. Proc. 19th Int. Conf. North American Fuzzy Information Processing Society, Atlanta, USA, July, pp. 301-306. IEEE
59. Labib, K. andVemuri, R. (2002) NSOM:A Tool to Detect Denial of Service Attacks Using Self-Organizing Maps. Technical Report. Department of Applied Science University of California, Davis, CA, USA
60. ErtÖz, L., Eilertson, E., Lazarevic, A., Ning Tan, P., Kumar, V. and Srivastava, J. (2004) The MINDS-Minnesota Intrusion Detection System. Next Generation Data Mining. MIT Press, Boston
61. Song, S., Ling, L. and Manikopoulo, C.N. (2006) Flow- Based Statistical Aggregation Schemes for Network Anomaly Detection. Proc. IEEE Int. Conf. Networking, Sensing, Florida, USA, April 23-25, pp. 786-791. IEEE
62. Mohajerani, M., Moeini, A. and Kianie, M. (2003) NFIDS: A Neuro-Fuzzy Intrusion Detection System. Proc. 10th IEEE Int. Conf. Electronics, Circuits and Systems(ICECS), Iran, December, pp. 348-351. IEEE Xplore
63. Zhang, Z., Li, J., Manikopoulos, C.N., Jorgenson, J. and Ucles, J. (2001) HIDE: A Hierarchical Network Intrusion Detection System Using Statistical Preprocessing and Neural Network Classification. Proc. 2001 IEEE Man Systems and Cybernetics Information Assurance Workshop, Seattle, WA, USA, April, pp. 85-90. IEEE Xplore
64. Sequeira, K. and Zaki, M. (2002) ADMIT: Anomaly-Based Data Mining for Intrusions. Proc. 8th ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, Edmonton, Alberta, Canada, pp. 386-395. ACM Press
65. Subramoniam, N., Pawar, P.S., Bhatnagar, M., Khedekar, N.S., Guntupalli, S., Satyanarayana, N., Vijayakumar, V.A., Ampatt, P.K., Ranjan, R. and Pandit, P.S. (2005) Development of a Comprehensive Intrusion Detection System- Challenges and Approaches. Proc. 1st Int. Conf. Information Systems Security (ICISS 2005),Kolkata, India, Lecture Notes in Computer Science 3803, pp. 332-335. Springer
66. Kuang, L.V. (2007) DNIDS: A dependable network intrusion detection system using the CSI-KNN algorithm. Master?s Thesis, Queen?s University Kingston, Ontario, Canada
67. Breunig, M.M., Kriegel, H.P., Ng, R.T. and Sander, J. (2000) LOF: Identifying Density-Based Local Outliers. Proc. 2000ACM SIGMOD Int. Conf. Management of Data, Dallas, TX, USA, May 16-18, Vol. 29, pp. 93-104, ACM
68. Petrovskiy, M.I. (2003) Outlier detection algorithms in data mining systems. Program. Comput. Softw., 29, 228-237
69. Otey, M.E., Parthasarathy, S. and Ghoting, A. (2005) Fast Lightweight Outlier Detection in Mixed-Attribute Data.Technical Report. Department of Computer Science and Engineering, The Ohio State University, Ohio, USA
70. Duan, L., Xu, L., Liu,Y. and Lee, J. (2008) Cluster-based outlier detection. Ann. Oper. Res., 168, 151-168
71. Lane, T. (2000) Machine learning techniques for the computer security domain of anomaly detection. PhD Thesis, Purdue University, Indiana, USA
72. Knorr, E.M. and Ng, R. (1998) Algorithms for Mining Distance- Based Outliers in Large Datasets. Proc. 24th Int. Conf.Very Large Data Bases (VLDB 1998), New York, NY, USA, August 24-27, pp. 392-403. Morgan Kaufmann.