Anomaly intrusion detection for evolving data stream based on semi-supervised learning

Authors:
Yan Yu;Shanqing Guo;Shaohua Lan;Tao Ban
Affiliations:
School of Compuer Science and Technology, Nanjing University of Science and Technology, Nanjing, P.R. China;School of Compuer Science and Technology, Shandong University, Jinan, P.R. China;School of Compuer Science and Technology, Nanjing University of Science and Technology, Nanjing, P.R. China;Information Security Research Center, National Institute of Information and Communications Technology, Tokyo, Japan
Venue:
ICONIP'08 Proceedings of the 15th international conference on Advances in neuro-information processing - Volume Part I
Year:
2008

Citing 11
Cited 0

The nature of statistical learning theory

The nature of statistical learning theory
BIRCH: an efficient data clustering method for very large databases

SIGMOD '96 Proceedings of the 1996 ACM SIGMOD international conference on Management of data
Bro: a system for detecting network intruders in real-time

Computer Networks: The International Journal of Computer and Telecommunications Networking
Models and issues in data stream systems

Proceedings of the twenty-first ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems
Constrained K-means Clustering with Background Knowledge

ICML '01 Proceedings of the Eighteenth International Conference on Machine Learning
Predicting rare classes: can boosting make any weak learner strong?

Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining
A probabilistic framework for semi-supervised clustering

Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining
On Change Diagnosis in Evolving Data Streams

IEEE Transactions on Knowledge and Data Engineering
Intrusion detection using an ensemble of intelligent paradigms

Journal of Network and Computer Applications - Special issue on computational intelligence on the internet
Evolving Connectionist Systems: The Knowledge Engineering Approach

Evolving Connectionist Systems: The Knowledge Engineering Approach
ADWICE – anomaly detection with real-time incremental clustering

ICISC'04 Proceedings of the 7th international conference on Information Security and Cryptology

Quantified Score

Hi-index	0.01

Visualization

Abstract

In network environment, time-varying traffic patterns make the detection model not characterize the current traffic accurately. At the same time, the deficiency of training samples also degrades the detection accuracy. This paper proposes an anomaly detection algorithm for evolving data stream based on semi-supervised learning. The algorithm uses data stream model with attenuation to solve the problem of the change of traffic patterns, as while as extended labeled dataset generated from semi-supervised learning is used to train detection model. The experimental results manifest that the algorithm have better accuracy than those based on all historical data equivalently by forgetting historical data gracefully, as while as be suitable for the situation of deficiency of labeled data.