Toward a more practical unsupervised anomaly detection system

Authors:
Jungsuk Song;Hiroki Takakura;Yasuo Okabe;Koji Nakao
Affiliations:
National Institute of Information and Communications Technology, 4-2-1, Nukui-Kitamachi, Koganei-shi, Tokyo 184-8795, Japan and Korea Institute of Science and Technology Information, 245 Daehangno ...;Information Technology Center, Nagoya University, Furo-cho, Chikusa-ku, Nagoya 464-8601, Japan;Academic Center for Computing and Media Studies, Kyoto University, Sakyo-ku, Kyoto 606-8501, Japan;National Institute of Information and Communications Technology, 4-2-1, Nukui-Kitamachi, Koganei-shi, Tokyo 184-8795, Japan
Venue:
Information Sciences: an International Journal
Year:
2013

Citing 8
Cited 6

An Intrusion-Detection Model

IEEE Transactions on Software Engineering - Special issue on computer security and privacy
An introduction to support Vector Machines: and other kernel-based learning methods

An introduction to support Vector Machines: and other kernel-based learning methods
Clustering intrusion detection alarms to support root cause analysis

ACM Transactions on Information and System Security (TISSEC)
Unsupervised anomaly detection in network intrusion detection using clusters

ACSC '05 Proceedings of the Twenty-eighth Australasian conference on Computer Science - Volume 38
Cooperation of Intelligent Honeypots to Detect Unknown Malicious Codes

WISTDCS '08 Proceedings of the 2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing
A Clustering Method for Improving Performance of Anomaly-Based Intrusion Detection System

IEICE - Transactions on Information and Systems
On the versatility of radial basis function neural networks: A case study in the field of intrusion detection

Information Sciences: an International Journal
Alarm clustering for intrusion detection systems in computer networks

MLDM'05 Proceedings of the 4th international conference on Machine Learning and Data Mining in Pattern Recognition

Editorial: Guest editorial: Special issue on data mining for information security

Information Sciences: an International Journal
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues

Information Sciences: an International Journal
Semantic security against web application attacks

Information Sciences: an International Journal
A new adaptive decentralized soft decision combining rule for distributed sensor systems with data fusion

Information Sciences: an International Journal
A generic framework for a compilation-based inference in probabilistic and possibilistic networks

Information Sciences: an International Journal
CoBAn: A context based model for data leakage prevention

Information Sciences: an International Journal

Quantified Score

Hi-index	0.07

Visualization

Abstract

During the last decade, various machine learning and data mining techniques have been applied to Intrusion Detection Systems (IDSs) which have played an important role in defending critical computer systems and networks from cyber attacks. Unsupervised anomaly detection techniques have received a particularly great amount of attention because they enable construction of intrusion detection models without using labeled training data (i.e., with instances preclassified as being or not being an attack) in an automated manner and offer intrinsic ability to detect unknown attacks; i.e., 0-day attacks. Despite the advantages, it is still not easy to deploy them into a real network environment because they require several parameters during their building process, and thus IDS operators and managers suffer from tuning and optimizing the required parameters based on changes of their network characteristics. In this paper, we propose a new anomaly detection method by which we can automatically tune and optimize the values of parameters without predefining them. We evaluated the proposed method over real traffic data obtained from Kyoto University honeypots. The experimental results show that the performance of the proposed method is superior to that of the previous one.