Journal
INTERNATIONAL JOURNAL OF RELIABILITY QUALITY AND SAFETY ENGINEERING
Volume 14, Issue 2, Pages 169-187Publisher
WORLD SCIENTIFIC PUBL CO PTE LTD
DOI: 10.1142/S0218539307002568
Keywords
Network intrusion detection; clustering algorithms; classification techniques
Categories
Ask authors/readers for more resources
Recently data mining methods have gained importance in addressing network security issues, including network intrusion detection - a challenging task in network security. Intrusion detection systems aim to identify attacks with a high detection rate and a low false alarm rate. Classification-based data mining models for intrusion detection are often ineffective in dealing with dynamic changes in intrusion patterns and characteristics. Consequently, unsupervised learning methods have been given a closer look for network intrusion detection. We investigate multiple centroid-based unsupervised clustering algorithms for intrusion detection, and propose a simple yet effective self-labeling heuristic for detecting attack and normal clusters of network traffic audit data. The clustering algorithms investigated include, k-means, Mixture-Of-Spherical Gaussians, Self-Organizing Map, and Neural-Gas. The network traffic datasets provided by the DARPA 1998 offline intrusion detection project are used in our empirical investigation, which demonstrates the feasibility and promise of unsupervised learning methods for network intrusion detection. In addition, a comparative analysis shows the advantage of clustering-based methods over supervised classification techniques in identifying new or unseen attack types.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available