Online detection of anomalous network flows with soft clustering

2015 7th International Conference on New Technologies, Mobility and Security - Proceedings of NTMS 2015 Conference and Workshops

Volumn , Issue , 2015, Pages

  Zolotukhin, Mikhail ^a   Hamalainen, Timo ^a   Kokkonen, Tero ^b   Siltanen, Jarmo ^b  

^a UNIVERSITY OF JYVÄSKYLÄ   (Finland)

^b JAMK UNIVERSITY OF APPLIED SCIENCES   (Finland)

Author keywords

Accuracy; Clustering algorithms; Feature extraction; Histograms; Intrusion detection; IP networks; Training

Indexed keywords

BEHAVIORAL RESEARCH; CLUSTERING ALGORITHMS; FEATURE EXTRACTION; MERCURY (METAL); PERSONNEL TRAINING;

ACCURACY; CLUSTERING TECHNIQUES; HISTOGRAMS; INTRUSION DETECTION APPROACHES; IP NETWORKS; ON-LINE DETECTION; SOFT CLUSTERING; USER BEHAVIORS;

INTRUSION DETECTION;

EID: 84960917628     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NTMS.2015.7266510     Document Type: Conference Paper

References (23)

1. "Cert coordination center http://www.cert.org/certcc.html," Jul. 2008.
2. A. Sperotto, G. Schaffrath, R. Sadre, C. Morariu, A. Pras, and B. Stiller, "An overview of ip flow-based intrusion detection," IEEE Communications Surveys & Tutorials, vol. 12, no. 3, pp. 343-356, 2010.
3. D. Gollmann, Computer Security. Wiley, 2nd edition, 2006.
4. R. Chitrakar and H. Chuanhe, "Anomaly based intrusion detection using hybrid learning approach of combining k-medoids clustering and nave bayes classification," in Proceedings of the 8th Int. Conf. on Wireless Communications, Networking and Mobile Computing, 2012, pp. 1-5.
5. M. Sato, H. Yamaki, and H. Takakura, "Unknown attacks detection using feature extraction from anomaly-based ids alerts," in Proceedings of the 12th IEEE/IPSJ International Symposium on Applications and the Internet (SAINT), 2012, pp. pp. 273-277.
6. A. Sperotto and A. Pras., "Flow-based intrusion detection," in Proceedings of IFIP/IEEE International Symposium on Integrated Network Management (IM), 2011, pp. 958-963.
7. Z. Jadidi, V. Muthukkumarasamy, E. Sithirasenan, and M. Sheikhan, "Flow-based anomaly detection using neural network optimized with gsa algorithm," in Proceedings of 33rd IEEE International Conference on Distributed Computing Systems Workshops, 2013, pp. 76-81.
8. P. Winter, E. Hermann, and M. Zeilinger, "Inductive intrusion detection in flow-based network data using one-class support vector machines," in Proceedings of 4th International Conference on New Technologies, Mobility and Security (NTMS), 2011, pp. 1-5.
9. M. Zolotukhin, T. Hämälaïnen, and A. Juvonen, "Growing hierarchical self-organizing maps and statistical distribution models for online detection of web attacks," Springer. Web Information Systems and Technologies. Lecture Notes in Business Information Processing, vol. 140, pp. 281-295, 2013.
10. Winter, "Inductive intrusion detection in flow-based network data using one-class support vector machines, msc thesis," 2010.
11. M. Chapple, T. Wright, and R. Winding, "Flow anomaly detection in firewalled networks," in Proceedings of Securecomm and Workshops, 2006, pp. 1-6.
12. R. Hofstede, V. Bartos, A. Sperotto, and A. Pras, "Towards realtime intrusion detection for netflow and ipfix," in Proceedings of the 9th International Conference on Network and Service Management (CNSM), 2013, pp. 227-234.
13. N. Muraleedharan, A. Parmar, and M. Kumar, "A flow based anomaly detection system using chi-square technique," in Proceedings of the 2nd IEEE International Advance Computing Conference, 2010, pp. 285-289.
14. M. de Assis, J. Rodrigues, and M. L. P. Junior, "A novel anomaly detection system based on seven-dimensional flow analysis," in Proceedings of IEEE Global Communications Conference (GLOBECOM), 2013, pp. 735-740.
15. L. Xie, Y. Wang, L. Chen, and G. Yue, "An anomaly detection method based on fuzzy c-means clustering algorithm," in Proceedings of the 2nd Int. Symp. on Networking and Network Security, 2010, pp. 89-92.
16. S. Song and C. Zhixiong, "Adaptive network flow clustering," in Proceedings of IEEE International Conference on Networking, Sensing and Control, 2007, pp. 596-601.
17. A. M. Chandrasekhar and K. Raghuveer, "Intrusion detection technique by using k-means, fuzzy neural network and svm classifiers," in Proceedings of IEEE International Conference on Networking, Sensing and Control, 2013, pp. 1-7.
18. J. Bilmes, "A gentle tutorial of the em algorithm and its application to parameter estimation for gaussian mixture and hidden markov models," Technical Report TR-97-021, ICSI, 1997.
19. C. Fraley and A. Raftery, "How many clusters? which clustering method? answers via model-based cluster analysi," The Computer Journal, vol. 41, pp. 578-588, 1998.
20. M. Rafsanjani, Z. Varzaneh, and N. Chukanlo, "A survey of hierarchical clustering algorithms," The Journal of Mathematics and Computer Science, vol. 5, no. 3, pp. 229-240, 2012.
21. "Jyvsectec-rgce-homepage," http://www.jyvsectec.fi/en/rgce/.
22. M. Zolotukhin, T. Hämälaïnen, T. Kokkonen, and J. Siltanen, "Analysis of http requests for anomaly detection of web attacks," in Proceedings of the 12th IEEE International Conference on Dependable, Autonomic and Secure Computing, 2014, pp. 406-411.
23. "Ministry of defence press release 8.5.2013, kyberturvallisuusharjoitus jyväskylässä 13.-17.5.2013," http://www.defmin.fi/ajankohtaista/tiedotteet/2013/kyberturvallisuusharjoitus jyvaskylassa 13.-17.5.2013.5502.news, 2013.