Data Mining for Intrusion Detection: From Outliers to True Intrusions

Authors:
Goverdhan Singh;Florent Masseglia;Céline Fiot;Alice Marascu;Pascal Poncelet
Affiliations:
INRIA Sophia Antipolis, 2004 route des lucioles, Sophia Antipolis, France FR-06902;INRIA Sophia Antipolis, 2004 route des lucioles, Sophia Antipolis, France FR-06902;INRIA Sophia Antipolis, 2004 route des lucioles, Sophia Antipolis, France FR-06902;INRIA Sophia Antipolis, 2004 route des lucioles, Sophia Antipolis, France FR-06902;LIRMM UMR CNRS 5506, Montpellier Cedex 5, France 34392
Venue:
PAKDD '09 Proceedings of the 13th Pacific-Asia Conference on Advances in Knowledge Discovery and Data Mining
Year:
2009

Citing 4
Cited 1

Probabilistic Alert Correlation

RAID '00 Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection
Data mining approaches for intrusion detection

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7
An overview of anomaly detection techniques: Existing solutions and latest technological trends

Computer Networks: The International Journal of Computer and Telecommunications Networking
A Multi-resolution Approach for Atypical Behaviour Mining

PAKDD '09 Proceedings of the 13th Pacific-Asia Conference on Advances in Knowledge Discovery and Data Mining

On the features and challenges of security and privacy in distributed internet of things

Computer Networks: The International Journal of Computer and Telecommunications Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

Data mining for intrusion detection can be divided into several sub-topics, among which unsupervised clustering has controversial properties. Unsupervised clustering for intrusion detection aims to i) group behaviors together depending on their similarity and ii) detect groups containing only one (or very few) behaviour. Such isolated behaviours are then considered as deviating from a model of normality and are therefore considered as malicious. Obviously, all atypical behaviours are not attacks or intrusion attempts. Hence, this is the limits of unsupervised clustering for intrusion detection. In this paper, we consider to add a new feature to such isolated behaviours before they can be considered as malicious. This feature is based on their possible repetition from one information system to another.