A latent class modeling approach to detect network intrusion

Authors:
Yun Wang;Inyoung Kim;Gaston Mbateng;Shih-Yieh Ho
Affiliations:
Center for Outcomes Research and Evaluation, Yale University and Yale-New Haven Health, CORE, 300 George Street, Suite 505, New Haven, CT 06511, USA and Qualidigm, 100 Roscommon Drive, Middletown, ...;Section of Biostatistics, School of Public Health, Yale University, 300 George Street, Suite 501, New Haven, CT 06511, USA;Qualidigm, 100 Roscommon Drive, Middletown, CT 06457, USA;Qualidigm, 100 Roscommon Drive, Middletown, CT 06457, USA
Venue:
Computer Communications
Year:
2006

Citing 5
Cited 2

The 1999 DARPA off-line intrusion detection evaluation

Computer Networks: The International Journal of Computer and Telecommunications Networking - Special issue on recent advances in intrusion detection systems
A framework for constructing features and models for intrusion detection systems

ACM Transactions on Information and System Security (TISSEC)
Statistical Foundations of Audit Trail Analysis for the Detection of Computer Misuse

IEEE Transactions on Software Engineering
Statistical Data Mining and Knowledge Discovery

Statistical Data Mining and Knowledge Discovery
Hierarchical Latent Class Models for Cluster Analysis

The Journal of Machine Learning Research

A triangle area based nearest neighbors approach to intrusion detection

Pattern Recognition
Review: Intrusion detection by machine learning: A review

Expert Systems with Applications: An International Journal

Quantified Score

Hi-index	0.25

Visualization

Abstract

This study presents a latent class modeling approach to examine network traffic data when labeled abnormal events are absent in training data, or such events are insufficient to fit a conventional regression model. Using six anomaly-associated risk factors identified from previous studies, the latent class model based on an unlabeled sample yielded acceptable classification results compared with a logistic regression model based on a labeled sample (correctly classified: 0.95 vs. 0.98, sensitivity: 0.99 vs. 0.99, and specificity: 0.77 vs. 0.97). The study demonstrates a great potency for using the latent class modeling technique to analyze network traffic data.