A Survey of Distance and Similarity Measures Used Within Network Intrusion Anomaly Detection

Abstract

Anomaly detection (AD) use within the network intrusion detection field of research, or network intrusion AD (NIAD), is dependent on the proper use of similarity and distance measures, but the measures used are often not documented in published research. As a result, while the body of NIAD research has grown extensively, knowledge of the utility of similarity and distance measures within the field has not grown correspondingly. NIAD research covers a myriad of domains and employs a diverse array of techniques from simple k-means clustering through advanced multiagent distributed AD systems. This review presents an overview of the use of similarity and distance measures within NIAD research. The analysis provides a theoretical background in distance measures and a discussion of various types of distance measures and their uses. Exemplary uses of distance measures in published research are presented, as is the overall state of the distance measure rigor in the field. Finally, areas that require further focus on improving the distance measure rigor in the NIAD field are presented.

A Two-Layer Dimension Reduction and Two-Tier Classification Model for Anomaly-Based Intrusion Detection in IoT Backbone Networks

“…Existing intrusion detection and prevention models generally use statistical approaches [15] such as Hidden Markov Model (HMM) [15], Bayes theory [16], cluster analysis [17], signal processing [18] and distance measuring [19] to detect anomalous activities. Anomaly detection approaches can be broadly categorized into supervised and unsupervised learning [6].…”

Bounded Fuzzy Possibilistic Method

“…where U is the (c × n) partition matrix, V = {v 1 , v 2 , ..., v c } is the vector of c cluster centers (prototypes) in d , m > 1 is the fuzzification constant, and ||.|| A is any inner product A-induced norm [18], i.e., ||X|| A = √ X T AX or the distance function such as Minkowski distance, presented by Eq. (5).…”

Mobile Botnet Detection Model based on Retrospective Pattern Recognition

“…This is a new metric which is designed to identify the connection between similarity of suspicious activities of a mobile client and other mobile devices in a network. The Pearson product correlation shown in formula 5 is selected to implement the proposed correlation index as it is commonly used in linear regression [27]. Similar to the HIS and VSI explained in the previous section, the correlation index is a retrospective metric.…”