Detecting anomalous network traffic with combined fuzzy-based approaches

Authors:
Hai-Tao He;Xiao-Nan Luo;Bao-Lu Liu
Affiliations:
Computer Application Institute, Sun Yat-sen University, Guangzhou, Guangdong, China;Computer Application Institute, Sun Yat-sen University, Guangzhou, Guangdong, China;College of Textile & Garment, Guangzhou University, Guangzhou, Guangdong, China
Venue:
ICIC'05 Proceedings of the 2005 international conference on Advances in Intelligent Computing - Volume Part II
Year:
2005

Citing 8
Cited 2

An Intrusion-Detection Model

IEEE Transactions on Software Engineering - Special issue on computer security and privacy
Data clustering: a review

ACM Computing Surveys (CSUR)
Inside the Slammer Worm

IEEE Security and Privacy
Worm Epidemics in High-Speed Networks

Computer
Optimized clustering for anomaly intrusion detection

PAKDD'03 Proceedings of the 7th Pacific-Asia conference on Advances in knowledge discovery and data mining
Intrusion detection in computer networks with neural and fuzzy classifiers

ICANN/ICONIP'03 Proceedings of the 2003 joint international conference on Artificial neural networks and neural information processing
Anomaly detection in IP networks

IEEE Transactions on Signal Processing
Intrusion detection techniques and approaches

Computer Communications

Review: The use of computational intelligence in intrusion detection systems: A review

Applied Soft Computing
Policy-enhanced ANFIS model to counter SOAP-related attacks

Knowledge-Based Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper introduces the combined fuzzy-based approaches to detect the anomalous network traffic such as DoS/DDoS or probing attacks, which include Adaptive Neuro-Fuzzy Inference System (ANFIS) and Fuzzy C-Means (FCM) clustering. The basic idea of the algorithm is: at first using ANFIS the original multi-dimensional (M-D) feature space of network connections is transformed to a compact one-dimensional (1-D) feature space, secondly FCM clustering is used to classify the 1-D feature space into the anomalous and the normal.PCA is also used for dimensional reduction of the original feature space during feature extraction. This algorithm combines the advantages of high accuracy in supervised learning technique and high speed in unsupervised learning technique. A publicly available DRAPA/KDD99 dataset is used to demonstrate the approaches and the results show their accuracy in detecting anomalies of the network connections.