Anomaly internet network traffic detection by kernel principle component classifier

Authors:
Hanghang Tong;Chongrong Li;Jingrui He;Jiajian Chen;Quang-Anh Tran;Haixin Duan;Xing Li
Affiliations:
Department of Automation, Tsinghua University, Beijing, China;Network Research Center of Tsinghua University, Beijing, China;Department of Automation, Tsinghua University, Beijing, China;Department of Automation, Tsinghua University, Beijing, China;Network Research Center of Tsinghua University, Beijing, China;Network Research Center of Tsinghua University, Beijing, China;Network Research Center of Tsinghua University, Beijing, China
Venue:
ISNN'05 Proceedings of the Second international conference on Advances in Neural Networks - Volume Part III
Year:
2005

Citing 8
Cited 0

On the self-similar nature of Ethernet traffic (extended version)

IEEE/ACM Transactions on Networking (TON)
Nonlinear component analysis as a kernel eigenvalue problem

Neural Computation
Learning nonstationary models of normal network traffic for detecting novel attacks

Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining
Novelty detection: a review—part 1: statistical approaches

Signal Processing
Novelty detection: a review—part 2: neural network based approaches

Signal Processing
Snort - Lightweight Intrusion Detection for Networks

LISA '99 Proceedings of the 13th USENIX conference on System administration
Bro: a system for detecting network intruders in real-time

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7
An overview of statistical learning theory

IEEE Transactions on Neural Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

As a crucial issue in computer network security, anomaly detection is receiving more and more attention from both application and theoretical point of view. In this paper, a novel anomaly detection scheme is proposed. It can detect anomaly network traffic which has extreme large value on some original feature by the major component, or does not follow the correlation structure of normal traffic by the minor component. By introducing kernel trick, the non-linearity of network traffic can be well addressed. To save the processing time, a simplified version is also proposed, where only major component is adopted. Experimental results validate the effectiveness of the proposed scheme.