Effects-based feature identification for network intrusion detection

Louvieris, Panos; Clewley, Natalie; Liu, Xiaohui

doi:10.1016/j.neucom.2013.04.038

Cited by 89 publications

(48 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This algorithm is different from the first three kinds of algorithms, it can not only extract the clustering of the boundary points, but also to cluster, effectively combine the two. TRICLUST, DTBOUND all belong to this kind of algorithm, in which TRICLUST focuses on the clustering function without boundary detection method and the results are given in detail [5].…”

Section: Graph Based Edge Detection Algorithmmentioning

confidence: 99%

Application of clustering analysis in Intrusion Detection

Zhang¹,

Li²,

Xu³

2017

The 3rd International Conference on Intelligent Energy and Power Systems (IEPS 2017)

View full text Add to dashboard Cite

Clustering technology and boundary point detection technology and its application in intrusion detection system are introduced in this paper from three aspects, which are the application of clustering analysis, boundary detection and clustering analysis in Intrusion Detection System. The data processing and the requirement of clustering algorithm for intrusion detection system are introduced in detail. Analyzed the result of the experiment environment and experiment, further validation of this project is based on the improved NPRIM algorithm applied to intrusion detection is effective and feasible. Boundary point detection technologyThe cluster boundary point is a point that has two or more clustering characteristics between the cluster and the cluster. The study of clustering boundary points is an important branch of clustering analysis, which plays an important role in disease prevention, biology, image retrieval, virtual reality, and improving clustering accuracy. Since Chenyi Xia first proposed the boundary point detection algorithm (BORDER) in 2006, researchers have proposed some boundary detection algorithms. In order to describe these algorithms, the algorithm is divided into four categories: density based boundary detection algorithm, grid based boundary detection algorithm and angle based boundary detection algorithm. Boundary point detection algorithm based on densityBased on the density of the boundary point detection algorithm is the use of clustering near the boundary of the uneven distribution of data objects to extract the characteristics of the clustering boundary point. On the noisy data set, the algorithm can separate the boundary point from the noise region, especially the uniform data set. BRIM is a typical boundary detection algorithm in this algorithm.In order to solve the existing problems of BORDER algorithm, BRIM is a density based boundary point detection algorithm, which can effectively detect the boundary of clustering in noisy data sets. The algorithm first according to the data object plus or minus the number of data points difference within half a neighborhood to calculating the boundary of points, and then the boundary is greater than the boundary degrees threshold  marked point boundary point.

show abstract

Section: Graph Based Edge Detection Algorithmmentioning

confidence: 99%

Application of clustering analysis in Intrusion Detection

Zhang¹,

Li²,

Xu³

2017

The 3rd International Conference on Intelligent Energy and Power Systems (IEPS 2017)

View full text Add to dashboard Cite

show abstract

“…Every new intrusion behavior is detected by the system, and the system will save the behavior and the related response of the security manager to the intrusion warehousing [5]. Similarly, the system can not automatically determine the normal access behavior of a system, the system will be stored in a typical normal access to the library.…”

Section: Typical Data Warehousingmentioning

confidence: 99%

Application of hospital information security intrusion detection system based on the new NPRIM algorithm

Li¹,

Xu²

2016

Proceedings of the 6th International Conference on Information Engineering for Mechanics and Materials

View full text Add to dashboard Cite

Abstract. The specific model of intrusion detection based on clustering and boundary points detection was elaborateed in this paper, and the data processing, clustering analysis, intrusion judgment, intrusion response, typical data warehousing the five stages are described in detail; Then the experimental environment and the experimental results were compared and analyzed, and further validation based on the improved NPRIM algorithm of the project team applied to intrusion detection is effective and feasible.

show abstract

“…The major concentration of these whole detection methods is direct to observe, differentiate and identify i.e malicious or non-malicious behaviours [6]. Procedure of discovering fundamental patterns and concealed relationships systematically from valuable information within the data to visualize and model interrelationship of the data itself are known as data mining process [17].…”

Section: IImentioning

confidence: 99%

“…Procedure of discovering fundamental patterns and concealed relationships systematically from valuable information within the data to visualize and model interrelationship of the data itself are known as data mining process [17]. Clustering and classification are common data mining algorithms and widely discovered and employed within the field of intrusion detection [6], [18], [19].…”

Section: IImentioning

confidence: 99%

See 1 more Smart Citation

An Improved Malicious Behaviour Detection Via k-Means and Decision Tree

Yassin¹,

Rahayu²,

Abdollah³

et al. 2016

ijacsa

View full text Add to dashboard Cite

Abstract-DataMining algorithm which is applied as an anomaly detection system has been considered as one of the essential techniques in malicious behaviour detection. Unfortunately, such detection system is known for its inclination in detecting a cyber-malicious activity more accurately (i.e. maximizing malicious and non-malicious behaviours detection) and has become a persistent limitation in the deployment of intrusion detection systems. Consequently, these constraints will affect a number of important performance factors such as the accuracy, detection rate and false alarms. In this research, KMDT proposed as an anomaly detection model that utilized kmeans clustering and decision tree classifier to maximize the detection of malicious behaviours by scrutinizing packet headers. The k-means clustering employed for labelling and plots the whole behaviours into identical cluster, which characterized the behaviours into suspicious or non-suspicious composition. Subsequently, these dissimilar clustered behaviours are reordered within two classes of types such as malicious and nonmalicious via decision tree classifier. KMDT is a profitable finding which improved the anomaly detection performance in identifying suspicious and non-suspicious behaviours as well as characterizes it into malicious and non-malicious behaviours more accurately. These criteria have been validated by the result from the experiments throughout banking system environment dataset 2016. KMDT have detected more malicious behaviours accurately as contrast to discrete and diversely combined methods.

show abstract

Effects-based feature identification for network intrusion detection

Cited by 89 publications

References 44 publications

Application of clustering analysis in Intrusion Detection

Application of clustering analysis in Intrusion Detection

Application of hospital information security intrusion detection system based on the new NPRIM algorithm

An Improved Malicious Behaviour Detection Via k-Means and Decision Tree

Contact Info

Product

Resources

About