Toward lightweight detection and visualization for denial of service attacks

Authors:
Dong Seong Kim;Sang Min Lee;Jong Sou Park
Affiliations:
Network Security Lab., Hankuk Aviation University, Seoul, Korea;Network Security Lab., Hankuk Aviation University, Seoul, Korea;Network Security Lab., Hankuk Aviation University, Seoul, Korea
Venue:
MICAI'06 Proceedings of the 5th Mexican international conference on Artificial Intelligence
Year:
2006

Citing 6
Cited 0

Wrappers for feature subset selection

Artificial Intelligence - Special issue on relevance
Random Forests

Machine Learning
Identifying Important Features for Intrusion Detection Using Support Vector Machines and Neural Networks

SAINT '03 Proceedings of the 2003 Symposium on Applications and the Internet
Pattern Classification (2nd Edition)

Pattern Classification (2nd Edition)
Toward modeling lightweight intrusion detection system through correlation-based hybrid feature selection

CISC'05 Proceedings of the First SKLOIS conference on Information Security and Cryptology
Fusions of GA and SVM for anomaly detection in intrusion detection system

ISNN'05 Proceedings of the Second international conference on Advances in Neural Networks - Volume Part III

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper, we present a lightweight detection and visualization methodology for Denial of Service (DoS) attacks. First, we propose a new approach based on Random Forest (RF) to detect DoS attacks. The classification accuracy of RF is comparable to that of Support Vector Machines (SVM). RF is also able to produce the importance value of individual feature. We adopt RF to select intrinsic important features for detecting DoS attacks in a lightweight way. And then, with selected features, we plot both DoS attacks and normal traffics in 2 dimensional space using Multi-Dimensional Scaling (MDS). The visualization results show that simple MDS can help one to visualize DoS attacks without any expert domain knowledge. The experimental results on the KDD 1999 intrusion detection dataset validate the possibility of our approach.