Ensemble methods for anomaly detection and distributed intrusion detection in Mobile Ad-Hoc Networks

Cabrera, J.B.D.; Gutierrez, Carlos Enrique; Mehra, Raman K.

doi:10.1016/j.inffus.2007.03.001

Cited by 71 publications

(37 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The method is based on the calculation of projection distances using multidimensional statistics and the Principal Component Analysis (PCA) to determine the axis that expresses the most relevant data correlations. Cabrera et al [12] propose a method to detect attacks on AODV and OLSR protocols. The method consists of three hierarchical and distributed intrusion detection modules based on pattern recognition and classifier fusion.…”

Section: Related Workmentioning

confidence: 99%

Anomaly Detection and Mitigation for Disaster Area Networks

Cucurull

Asplund

Nadjm‐Tehrani

2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. One of the most challenging applications of wireless networking are in disaster area networks where lack of infrastructure, limited energy resources, need for common operational picture and thereby reliable dissemination are prevalent. In this paper we address anomaly detection in intermittently connected mobile ad hoc networks in which there is little or no knowledge about the actors on the scene, and opportunistic contacts together with a store-and-forward mechanism are used to overcome temporary partitions. The approach uses a statistical method for detecting anomalies when running a manycast protocol for dissemination of important messages to k receivers. Simulation of the random walk gossip (RWG) protocol combined with detection and mitigation mechanisms is used to illustrate that resilience can be built into a network in a fully distributed and attack-agnostic manner, at a modest cost in terms of drop in delivery ratio and additional transmissions. The approach is evaluated with attacks by adversaries that behave in a similar manner to fair nodes when invoking protocol actions.

show abstract

Section: Related Workmentioning

confidence: 99%

Anomaly Detection and Mitigation for Disaster Area Networks

Cucurull

Asplund

Nadjm‐Tehrani

2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The term PðU ¼ ujY ¼ yÞ will be represented by another parameter, the component weight. 4 Finally, we must separately estimate PðY ¼ yÞ from the data, thus obtaining the conditional probability given the observations:…”

Section: Discussionmentioning

confidence: 99%

“…Bose et al [2] proposed a cooperative and distributed intrusion detection system that uses data from the MAC, routing and application layers, coupled with a Bayesian classifier. Cabrera et al [4] use an ensemble of classifiers obtained by training multiple C 4.5 classifiers and evaluate them on a MANET network for two types of attacks. Abdel-Fattah et al [1] use the Conformal Predictor k-nearest neighbour and the Distance based Outlier Detection (CPDOD) algorithms to perform intrusion detection in MANETs against three types of attacks while Shim et al [32] have used a cluster analysis technique in order to detect Sinkhole attacks in MANETs [12].…”

Section: Related Workmentioning

confidence: 99%

Intrusion detection in MANET using classification algorithms: The effects of cost and model selection

Mitrokotsa

Dimitrakakis

2013

Ad Hoc Networks

View full text Add to dashboard Cite

a b s t r a c tIntrusion detection is frequently used as a second line of defense in Mobile Ad-hoc Networks (MANETs). In this paper we examine how to properly use classification methods in intrusion detection for MANETs. In order to do so we evaluate five supervised classification algorithms for intrusion detection on a number of metrics. We measure their performance on a dataset, described in this paper, which includes varied traffic conditions and mobility patterns for multiple attacks. One of our goals is to investigate how classification performance depends on the problem cost matrix. Consequently, we examine how the use of uniform versusweighted cost matrices affects classifier performance. A second goal is to examine techniques for tuning classifiers when unknown attack subtypes are expected during testing. Frequently, when classifiers are tuned using cross-validation, data from the same types of attacks are available in all folds. This differs from real-world employment where unknown types of attacks may be present. Consequently, we develop a sequential cross-validation procedure so that not all types of attacks will necessarily be present across all folds, in the hope that this would make the tuning of classifiers more robust. Our results indicate that weighted cost matrices can be used effectively with most statistical classifiers and that sequential cross-validation can have a small, but significant effect for certain types of classifiers.

show abstract

“…Research on developing innovative, hybrid or ensemble based classifiers [1]- [4], feature selection techniques [5]- [8], and on the training dataset. Research on dataset is minimal.…”

Section: Related Workmentioning

confidence: 99%

Analysis of the Effect of Clustering the Training Data in Naive Bayes Classifier for Anomaly Network Intrusion Detection

Subramanian¹,

Ong²

2014

JACN

View full text Add to dashboard Cite

Abstract-This paper presents the analysis of the effect of clustering the training data and test data in classification efficiency of Naive Bayes classifier. KDD cup 99 benchmark dataset is used in this research. The training set is clustered using k means clustering algorithm into 5 clusters. Then 8800 samples are taken from the clusters to form the training and test set. The results are compared with that of two Naive Bayes classifiers trained on random sampled data containing 8800 and 17600 instances respectively. The main contribution of this paper is that it is empirically proved that the training set derived from clusters generated by k-means clustering algorithm improves the classification efficiency of the Naive Bayes classifier. The results show the accuracy of the Naive Bayes classifier trained with clustered instances is 94.4% while that of normal instances are 85.41% and 89.26%.

show abstract

Ensemble methods for anomaly detection and distributed intrusion detection in Mobile Ad-Hoc Networks

Cited by 71 publications

References 43 publications

Anomaly Detection and Mitigation for Disaster Area Networks

Anomaly Detection and Mitigation for Disaster Area Networks

Intrusion detection in MANET using classification algorithms: The effects of cost and model selection

Analysis of the Effect of Clustering the Training Data in Naive Bayes Classifier for Anomaly Network Intrusion Detection

Contact Info

Product

Resources

About