Modification of supervised OPF-based intrusion detection systems using unsupervised learning and social network concept

Pattern Recognition

Volumn 62, Issue , 2017, Pages 56-72

  Bostani, Hamid ^a   Sheikhan, Mansour ^a  

^a ISLAMIC AZAD UNIVERSITY   (Iran)

Author keywords

Centrality; Classification; Clustering; Optimum path forest; Prestige; Pruning; Social network analysis

Indexed keywords

ARTIFICIAL INTELLIGENCE; CLASSIFICATION (OF INFORMATION); COMPUTER CRIME; FORESTRY; GRAPHIC METHODS; INTRUSION DETECTION; LEARNING ALGORITHMS; LEARNING SYSTEMS; MERCURY (METAL); SOCIAL NETWORKING (ONLINE);

CENTRALITY; CLUSTERING; OPTIMUM-PATH FORESTS; PRESTIGE; PRUNING;

CLUSTERING ALGORITHMS;

EID: 84994896280     PISSN: 00313203     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.patcog.2016.08.027     Document Type: Article

References (80)

1. [1] Das, V., Pathak, V., Sharma, S., Sreevathsan, R., Srikanth, M., Kumar, G., Network intrusion detection system based on machine learning algorithms. Int. J. Comput. Sci. Inf. Technol. 2 (2010), 138–151, 10.1016/j.asoc.2009.06.019.
2. [2] Wu, S., Yen, E., Data mining-based intrusion detectors. Expert Syst. Appl. 36 (2009), 5605–5612, 10.1016/j.eswa.2008.06.138.
3. [3] Stakhanova, N., Basu, S., Wong, J., On the symbiosis of specification-based and anomaly-based detection. Comput. Secur. 29 (2010), 253–268, 10.1016/j.cose.2009.08.007.
4. [4] Golmah, V., An efficient hybrid intrusion detection system based on C5.0 and SVM. Int. J. Database Theory Appl. 7 (2014), 59–70, 10.14257/ijdta.2014.7.2.06.
5. [5] Kim, G., Lee, S., Kim, S., A novel hybrid intrusion detection method integrating anomaly detection with misuse detection. Expert Syst. Appl. 41 (2014), 1690–1700, 10.1016/j.eswa.2013.08.066.
6. [6] M. Sheikhan, Artificial neural network models for intrusion detection, in: Encyclopedia of Information Assurance, Taylor & Francis, New York, 2014, pp. 1–12, http://dx.doi.org/10.1081/E-EIA-120051983.
7. [7] Wu, S.X., Banzhaf, W., The use of computational intelligence in intrusion detection systems: a review. Appl. Soft Comput. 10 (2010), 1–35, 10.1016/j.asoc.2009.06.019.
8. [8] Y., Li, L., Guo, An active learning based TCM-KNN algorithm for supervised network intrusion detection. Comput. Secur. 26 (2007), 459–467, 10.1016/j.cose.2007.10.002.
9. [9] KDD Cup 99 Intrusion detection data set, Available on 〈http://kdd.ics.uci.edu/databases/kddcup99〉, (accessed 20.02.15).
10. [10] Yi, Y., Wu, J., Xu, W., Incremental SVM based on reserved set for network intrusion detection. Expert Syst. Appl. 38 (2011), 7698–7707, 10.1016/j.eswa.2010.12.141.
11. [11] Ru, X., Liu, Z., Huang, Z., Jiang, W., Normalized residual-based constant false-alarm rate outlier detection. Pattern Recognit. Lett. 69 (2016), 1–7, 10.1016/j.patrec.2015.10.002.
12. [12] Rajasegarar, S., Gluhak, A., Imran, M.A., Nati, M., Moshtaghi, M., Leckie, C., Palaniswami, M., Ellipsoidal neighbourhood outlier factor for distributed anomaly detection in resource constrained networks. Pattern Recognit. 47 (2014), 2867–2879, 10.1016/j.patcog.2014.04.006.
13. [13] Xue, Z., Shang, Y., Feng, A., Semi-supervised outlier detection based on fuzzy rough C-means clustering. Math. Comput. Simul. 80 (2010), 1911–1921, 10.1016/j.matcom.2010.02.007.
14. [14] Daneshpazhouh, A., Sami, A., Entropy-based outlier detection using semi-supervised approach with few positive examples. Pattern Recognit. Lett. 49 (2014), 77–84, 10.1016/j.patrec.2014.06.012.
15. [15] Yeung, D.Y., Ding, Y., Host-based intrusion detection using dynamic and static behavioral models. Pattern Recognit. 36 (2003), 229–243, 10.1016/S0031-3203(02)00026-2.
16. [16] Xiang, C., Yong, P.C., Meng, L.S., Design of multiple-level hybrid classifier for intrusion detection system using Bayesian clustering and decision trees. Pattern Recognit. Lett. 29 (2008), 918–924, 10.1016/j.patrec.2008.01.008.
17. [17] Wang, G., Hao, J., Ma, J., Huang, L., A new approach to intrusion detection using artificial neural networks and fuzzy clustering. Expert Syst. Appl. 37 (2010), 6225–6232, 10.1016/j.eswa.2010.02.102.
18. [18] Aburomman, A.A., Reaz, M.B.I., A novel SVM-kNN-PSO ensemble method for intrusion detection system. Appl. Soft Comput. 38 (2016), 360–372, 10.1016/j.asoc.2015.10.011.
19. [19] Papa, J.P., Falcão, A.X., Suzuki, C.T.N., Supervised pattern classification based on optimum-path forest. Int. J. Imaging Syst. Technol. 19 (2009), 120–131.
20. [20] W.P. Amorim, M.H. Carvalho, Supervised learning using local analysis in an optimal-path forest, in: Proceedings of the 25th Conference on Graphics, Patterns and Images, Ouro Preto, Brazil, 2012, pp. 330–335. 10.1109/SIBGRAPI.2012.53.
21. [21] M. Tavallaee, E. Bagheri, L. Wei, A. Ghorbani, NSL-KDD Data Set Available on 〈http://nsl.cs.unb.ca/NSL-KDD〉, (accessed 20.02.15).
22. [22] Jiang, S.Y., Song, X., Wang, H., Han, J.J., Li, Q.H., A clustering-based method for unsupervised intrusion detections. Pattern Recognit. Lett. 27 (2006), 802–810, 10.1016/j.patrec.2005.11.007.
23. [23] Tsai, C.F., Lin, C.Y., A triangle area based nearest neighbors approach to intrusion detection. Pattern Recognit. 43 (2010), 222–229, 10.1016/j.patcog.2009.05.017.
24. [24] Lin, W.C., Ke, S.W., Tsai, C.F., CANN: An intrusion detection system based on combining cluster centers and nearest neighbors. Knowl. Based Syst. 78 (2015), 13–21, 10.1016/j.knosys.2015.01.009.
25. [25] Pereira, C.R., Nakamura, R.Y.M., Costa, K.A.P., Papa, J.P., An optimum-path forest framework for intrusion detection in computer networks. Eng. Appl. Artif. Intell. 25 (2012), 1226–1234, 10.1016/j.engappai.2012.03.008.
26. [26] Papa, J.P., Falcão, A.X., Albuquerque, V.H.C., Tavares, J.M.R.S., Efficient supervised optimum-path forest classification for large datasets. Pattern Recognit. 45 (2012), 512–520, 10.1016/j.patcog.2011.07.013.
27. [27] Iwashita, A.S., Papa, J.P., Souza, A.N., Falcão, A.X., Lotufo, R.A., Oliveira, V.M., de Albuquerque, V.H.C., Tavare, J.M.R.S., A path- and label-cost propagation approach to speed up the training of the optimum-path forest classifier. Pattern Recognit. Lett. 40 (2014), 121–127, 10.1016/j.patrec.2013.12.018.
28. [28] Souza, R., Rittner, L., Lotufo, R., A comparison between k-optimum path forest and k-nearest neighbors supervised classifiers. Pattern Recognit. Lett. 39 (2014), 2–10, 10.1016/j.patrec.2013.08.030.
29. [29] Saito, P.T.M., Suzuki, C.T.N., Gomes, J.F., de Rezende, P.J., Falcão, A.X., Robust active learning for the diagnosis of parasites. Pattern Recognit. 48 (2015), 3572–3583, 10.1016/j.patcog.2015.05.020.
30. [30] Costa, K.A.P., Pereira, L.A.M., Nakamura, R.Y.M., Pereira, C.R., Papa, J.P., Falcão, A.X., A nature-inspired approach to speed up optimum-path forest clustering and its application to intrusion detection in computer networks. Inf. Sci. 294 (2015), 95–108, 10.1016/j.ins.2014.09.025.
31. [31] Osaku, D., Nakamura, R.Y.M., Pereira, L.A.M., Pisani, R.J., Levada, A.L.M., Cappabianco, F.A.M., Falcão, A.X., Papa, J.P., Improving land cover classification through contextual-based optimum-path forest. Inf. Sci. 324 (2015), 60–87, 10.1016/j.ins.2015.06.020.
32. [32] Klein, A., Ahlf, H., Sharma, V., Social activity and structural centrality in online social networks. Telemat. Inform. 32 (2015), 321–332, 10.1016/j.tele.2014.09.008.
33. [33] Yan, X., Zhai, L., Fan, W., C-index: a weighted network node centrality measure for collaboration competence. J. Informetr. 7 (2013), 223–239, 10.1016/j.joi.2012.11.004.
34. [34] Qi, X., Fuller, E., Luo, R., Zhang, C., A novel centrality method for weighted networks based on the Kirchhoff polynomial. Pattern Recognit. Lett. 58 (2015), 51–60, 10.1016/j.patrec.2015.02.007.
35. [35] Kundu, S., Pal, S.K., Fuzzy-rough community in social networks. Pattern Recognit. Lett. 67 (2015), 145–152, 10.1016/j.patrec.2015.02.005.
36. [36] Qi, X., Tang, W., Wu, Y., Guo, G., Fuller, E., Zhang, C.Q., Optimal local community detection in social networks based on density drop of subgraphs. Pattern Recognit. Lett. 36 (2014), 46–53, 10.1016/j.patrec.2013.09.008.
37. [37] J. MacQueen, Some methods for classification and analysis of multivariate observations, in: Proceedings of the 5th Berkeley Symposium on Mathematical Statistics and Probability, Oakland, USA, 1967.
38. [38] O. Sangita, J. Dhanamma, An improved k-means clustering approach for teaching evaluation, in: Advances in Computing, Communication and Control, Springer, 2011, pp. 108–115, http://dx.doi.org/10.1007/978-3-642-18440-6_13.
39. [39] Bakshi, S., Jagadev, A.K., Dehuri, S., Wang, G., Enhancing scalability and accuracy of recommendation systems using unsupervised learning and particle swarm optimization. Appl. Soft Comput. 15 (2014), 21–29, 10.1016/j.asoc.2013.10.018.
40. [40] C. Legány, S. Juhász, A. Babos, Cluster validity measurement techniques, in: Proceedings of 5th WSEAS International Conference on Artificial Intelligence, Knowledge Engineering and Data Bases, Madrid, Spain, 2006, pp. 388–393.
41. [41] Dunn, J.C., Well separated clusters and optimal fuzzy partitions. J. Cybern. 4 (1974), 95–104, 10.1080/01969727408546059.
42. [42] Theodoridis, S., Koutroumbas, K., Pattern Recognition, 4th edition, 2008, Elsevier, Burlington, MA, USA.
43. [43] Pal, N.R., Biswas, J., Cluster validation using graph theoretic concepts. Pattern Recognit. 30 (1997), 847–857, 10.1016/S0031-3203(96)00127-6.
44. [44] Rousseeuw, P.J., Silhouettes: a graphical aid to the interpretation and validation of cluster analysis. J. Comput. Appl. Math. 20 (1987), 53–65, 10.1016/0377–0427(87)90125-7.
45. [45] Davies, D.L., Bouldin, D.W., A cluster separation measure. IEEE Trans. Pattern Anal. Mach. Intell. 1 (1979), 224–227, 10.1109/TPAMI.1979.4766909.
46. [46] Yeh, J.H., Joung, F.J., Lin, J.C., CDV index: a validity index for better clustering quality measurement. J. Comput. Commun. 2 (2014), 163–171, 10.4236/jcc.2014.24022.
47. [47] S. Petrović, A comparison between the Silhouette index and the Davies-Bouldin index in labeling IDS clusters, in: Proceedings of the 11th Nordic Workshop on Secure IT-systems, Linkoping, Sweden, 2006, pp. 53–64.
48. [48] S. Ray, R.H. Turi, Determination of number of clusters in k-means clustering and application in colour image segmentation, in: Proceedings of the 4th International Conference on Advances in Pattern Recognition and Digital Techniques, Calcutta, India, 1999, pp. 137–143.
49. [49] Wasserman, S., Faust, K., Social Network Analysis: Methods and Applications. 1994, Cambridge University Press, New York.
50. [50] K. Musiał, P. Kazienko, P. Bródka, User position measures in social networks, in: Proceedings of the 3rd Workshop on Social Network Mining and Analysis, New York, USA, 2009. 10.1145/1731011.1731017.
51. [51] A. Rusinowska, R. Berghammer, H.D. Swart, M. Grabisch, Social networks: prestige, centrality, and influence, in: Relational and Algebraic Methods in Computer Science, Springer, 2011, pp. 22–39, 10.1007/978-3-642-21070-9_2.
52. [52] Y.M. Kim, A preliminary social network analysis of MPACT, in: Annual Meeting Proceedings Information Science with Impact: Research in and for the Community, 2007, pp. 1–10 〈https://www.asis.org/Conferences/AM07/proceedings/posters/79/79_poster.html〉.
53. [53] I. Varlamis, M. Eirinaki, M. Louta, Application of social network metrics to a trust-aware collaborative model for generating personalized user recommendations, in: The Influence of Technology on Social Network Analysis and Mining, Springer, 2013, pp. 49–74, 10.1007/978-3-7091-1346-2_3.
54. [54] L.G. Pérez, F. Chiclana, S. Ahmadi, A social network representation for collaborative filtering recommender systems, in: Proceedings of 11th International Conference on Intelligent Systems Design and Applications, Córdoba, Spain, 2011, pp. 438–443. 10.1109/ISDA.2011.6121695.
55. [55] W. Wang, X. Zhang, S. Gombault, S.J. Knapskog, Attribute normalization in network intrusion detection, in: Proceeding of 10th International Symposium on Pervasive Systems, Algorithms, and Networks, Kaohsiung, Taiwan, 2009, pp. 448–453. 10.1109/I-SPAN.2009.49.
56. [56] D.A. Bader, S. Kintali, K. Madduri, M. Mihail, Approximating betweenness centrality, in: Proceedings of 5th International Conference on Algorithms and Models for the Web-Graph, San Diego, CA, USA, 2007, pp. 124–137. 10.1007/978-3-540-77004-6_10.
57. [57] U. Kang, S. Papadimitriou, J. Sun, H. Tong, Centralities in large networks: algorithms and observations, in: Proceedings of the SIAM International Conference on Data Mining, Mesa, Arizona, USA, 2011. 10.1137/1.9781611972818.11.
58. [58] Portes dos Santos, E., Xavier, C.R., Goldfeld, P., Dickstein, F., Weber dos Santos, R., Comparing genetic algorithms and Newton-like methods for the solution of the history matching problem. Lect. Notes Comput. Sci. 5544 (2009), 377–386.
59. [59] M. Tavallaee, E. Bagheri, L. Wei, A. Ghorbani, Detailed analysis of the KDD CUP 99 data set, in: IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, Canada, 2009, pp. 1–6. 10.1109/CISDA.2009.5356528.
60. [60] Lahre, K., Diwan, T.D., Kashyap, S.K., Agrawal, P., Analyze different approaches for IDS using KDD 99 data set. Int. J. Recent Innov. Trends Comput. Commun. 1 (2013), 645–651.
61. [61] Sheikhan, M., Jadidi, Z., Farrokhi, A., Intrusion detection using reduced-size RNN based on feature grouping. Neural Comput. Appl. 21 (2012), 1185–1190, 10.1007/s00521-010-0487-0.
62. [62] Raj Kumar, P.A., Selvakumar, S., Distributed denial of service attack detection using an ensemble of neural classifier. Comput. Commun. 34 (2011), 1328–1341, 10.1016/j.comcom.2011.01.012.
63. [63] Raj Kumar, P.A., Selvakumar, S., Detection of distributed denial of service attacks using an ensemble of adaptive and hybrid neuro-fuzzy systems. Comput. Commun. 36 (2013), 303–319, 10.1016/j.comcom.2012.09.010.
64. [64] Ippoliti, D., Zhou, X., A-GHSOM: an adaptive growing hierarchical self organizing map for network anomaly detection. J. Parallel Distrib. Comput. 72 (2012), 1576–1590, 10.1016/j.jpdc.2012.09.004.
65. [65] Davis, J.J., Clark, A.J., Data preprocessing for anomaly based network intrusion detection: a review. Comput. Secur. 30 (2011), 353–375, 10.1016/j.cose.2011.05.008.
66. [66] S.T. Ikram, A.K. Cherukuri, Intrusion detection model using fusion of chi-square feature selection and multi class SVM, J. King Saud Univ. – Comput. Inf. Sci., 2016 (in press). 10.1016/j.jksuci.2015.12.004.
67. [67] Laskov, P., Dussel, P., Schafer, C., Rieck, K., Learning intrusion detection: supervised or unsupervised?. Image Anal. Process., 2005, 50–57.
68. [68] De La Hoz, E., Hoz, E. De. La, Ortiz, A., Ortega, J., Prieto, B., PCA filtering and probabilistic SOM for network intrusion detection. Neurocomputing 164 (2015), 71–81, 10.1016/j.neucom.2014.09.083.
69. [69] Y. Bouzida, F. Cuppens, N. Cuppens-Boulahia, S. Gombault, Efficient intrusion detection using principal component analysis, in: Proceedings of the 3ème Conférence sur la Sécurite´ et Architectures Réseaux (SAR), Orlando, FL, USA, 2004.
70. [70] Bhuyan, M.H., Bhattacharyya, D.K., Kalita, J.K., A multi-step outlier-based anomaly detection approach to network-wide traffic. Inf. Sci. 348 (2016), 243–271, 10.1016/j.ins.2016.02.023.
71. [71] Amiri, F., Rezaei Yousefi, M.M., Lucas, C., Shakery, A., Yazdani, N., Mutual information-based feature selection for intrusion detection systems. J. Netw. Comput. Appl. 34 (2011), 1184–1199, 10.1016/j.jnca.2011.01.002.
72. [72] Rastegari, S., Hingston, P., Lam, C.-P., Evolving statistical rulesets for network intrusion detection. Appl. Soft Comput. 33 (2015), 348–359, 10.1016/j.asoc.2015.04.041.
73. [73] Herlocker, J., Konstan, J.A., Riedl, J., An empirical analysis of design choices in neighborhood-based collaborative filtering algorithms. Inf. Retr. 5 (2002), 287–310, 10.1023/A:1020443909834.
74. [74] Duda, R.O., Hart, P.E., Stork, D.G., Pattern Classification, 2nd edition, 2000, John Wiley & Sons, New York.
75. [75] Agrawal, R., Joshi, M.V., PNrule: A New Framework for Learning Classifier Models in Data Mining (a case-study in network intrusion detection), IBM Research Division, Report No. RC-21719, 2000.
76. [76] Vidhya, V., A review of DoS attacks in cloud computing. IOSR J. Comput. Eng. 16 (2014), 32–35.
77. [77] Seon, C.N., Lee, H., Kim, H., Seo, J., Improving domain action classification in goal-oriented dialogues using a mutual retraining method. Pattern Recognit. Lett. 45 (2014), 154–160, 10.1016/j.patrec.2014.03.021.
78. [78] Gerlein, E.A., McGinnity, M., Belatreche, A., Coleman, S., Evaluating machine learning classification for financial trading: an empirical approach. Expert Syst. Appl. 54 (2016), 193–207, 10.1016/j.eswa.2016.01.018.
79. [79] Folino, G., Sabatino, P., Ensemble based collaborative and distributed intrusion detection systems: a survey. J. Netw. Comput. Appl. 66 (2016), 1–16, 10.1016/j.jnca.2016.03.011.
80. [80] Inayat, Z., Gani, A., Anuar, N.B., Khurram Khan, M., Anwa, S., Intrusion response systems: foundations, design, and challenges. J. Netw. Comput. Appl. 62 (2016), 53–74, 10.1016/j.jnca.2015.12.006.