Efficient intrusion detection using representative instances

Guo, Chun; Zhou, Yiming; Ping, Yuan; Si, Luo; Lai, Yuping; Zhang, Zhongkun

doi:10.1016/j.cose.2013.08.003

Cited by 24 publications

(15 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…During this experiment, we compared two approaches, the first is a One Class Support Vector Machine (OCSVM)-based technique to detect malicious activities from flows [3], the second is a representative instance selection technique proposed to select representative samples of flows and use them as input to several data mining classification techniques [25]. In order to make our experiments consistent with the settings of the experiments conducted on these approaches, we minimized the number of benign flows in our experiment.…”

Section: B Comparison With Other Flow-based Id Approachesmentioning

confidence: 97%

Context Infusion in Semantic Link Networks to Detect Cyber-attacks: A Flow-Based Detection Approach

Aleroud

Karabatis

2014

2014 IEEE International Conference on Semantic Computing

View full text Add to dashboard Cite

Detection of cyber-attacks is a major responsibility for network managers and security specialists. Most existing Network Intrusion Detection systems rely on inspecting individual packets, an increasingly resource consuming task in today's high speed networks due to the overhead associated with accessing packet content. An alternative approach is to detect attack patterns by investigating IP flows. Since analyzing raw data extracted from IP flows lacks the semantic information needed to discover attacks, a novel approach is introduced that utilizes contextual information to semantically reveal cyberattacks from IP flows. Time, location, and other contextual information mined from network flow data is utilized to create semantic links among alerts raised in response to suspicious flows. The semantic links are identified through an inference process on probabilistic semantic link networks (SLNs). The resulting links are used at run-time to retrieve relevant suspicious activities that represent possible steps in multi-step attacks.

show abstract

Section: B Comparison With Other Flow-based Id Approachesmentioning

confidence: 97%

Context Infusion in Semantic Link Networks to Detect Cyber-attacks: A Flow-Based Detection Approach

Aleroud

Karabatis

2014

2014 IEEE International Conference on Semantic Computing

View full text Add to dashboard Cite

show abstract

“…In [22], the authors presented a representative instance selection approach to preprocess the training set. Their proposed method is independent of the learning algorithm, which is applied to construct the IDS.…”

Section: Related Workmentioning

confidence: 99%

“…Comparison with the representative instances approach. As mentioned in Section 2, Guo et al [22] proposed a non-incremental IDS using representative instances. In their experiments, they have applied 400,000 flows from the Sperotto dataset as described in Section 4.2.…”

Section: Evaluation Metricsmentioning

confidence: 99%

An incremental intrusion detection system using a new semi‐supervised stream classification method

Noorbehbahani

Fanian

Mousavi

et al. 2015

Int J Communication

View full text Add to dashboard Cite

SUMMARYIn recent years, the utilization of machine learning and data mining techniques for intrusion detection has received great attention by both security research communities and intrusion detection system (IDS) developers. In intrusion detection, the most important constraints are the imbalanced class distribution, the scarcity of the labeled data, and the massive amounts of network flows. Moreover, because of the dynamic nature of the network flows, applying static learned models degrades the detection performance significantly over time. In this article, we propose a new semi-supervised stream classification method for intrusion detection, which is capable of incremental updating using limited labeled data. The proposed method, called the incremental semi-supervised flow network-based IDS (ISF-NIDS), relies on an incremental mixed-data clustering, a new supervised cluster adjustment method, and an instance-based learning. The ISF-NIDS operates in real time and learns new intrusions quickly using limited storage and processing power. The experimental results on the KDD99, Moore, and Sperotto benchmark datasets indicate the superiority of the proposed method compared with the existing state-of-the-art incremental IDSs.

show abstract

“…The proposed method is an attempt to improve the time and space complexity of the representative method described in the work [8].…”

Section: Proposed Methodsmentioning

confidence: 99%

“…Some of the AI algorithms like ANN and SVM having a high computational cost, while handling a huge number of instances in datasets [8]. As the size of training dataset increases, the computational complexity also increases.…”

Section: Introductionmentioning

confidence: 99%

Partial Least Square based Improved Intrusion Detection System

Sangve¹,

Kulkarni²

2017

IJCA

View full text Add to dashboard Cite

Various Artificial Intelligence (AI) based computing techniques for intrusion detection has been proposed using popular large-scale datasets like DARPA 98 and KDD Cup 99. However, AI based systems such as using representative instances are computationally inefficient. In this paper, the computationally efficient approach is proposed for anomaly detection by combining Partial Least Square (PLS) and technique of extracting representative instances. The PLS helps in feature selection and provides dimensionality reduction. Further, to decline the processing time the representative instances are properly chosen from the data set before classification. The classic instances are selected from the subsets of data which are obtained by Centroid-based partitioning technique. The system utilizes these paradigmatic instances as a training set. Finally, KNN classifier is trained using these paradigmatic instances. The results obtained using the proposed approach indicates a considerable fall in the processing time and space utilization.

show abstract

Efficient intrusion detection using representative instances

Cited by 24 publications

References 28 publications

Context Infusion in Semantic Link Networks to Detect Cyber-attacks: A Flow-Based Detection Approach

Context Infusion in Semantic Link Networks to Detect Cyber-attacks: A Flow-Based Detection Approach

An incremental intrusion detection system using a new semi‐supervised stream classification method

Partial Least Square based Improved Intrusion Detection System

Contact Info

Product

Resources

About