On the capability of an SOM based intrusion detection system

Kayacık, H. Güneş; Zincir-Heywood, A. Nur; Heywood, Malcolm I.

doi:10.1109/ijcnn.2003.1223682

Cited by 104 publications

(83 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Specific experimental results will be given to different K values (4,6,8,10,14,20), and the parameter of anomaly threshold value β will be taken as 1%. As revealed in the results of Table 2, when the values of clustering number K are taken within the range of 4-20, there are no significant fluctuations in the detection performance.…”

Section: Experiments and Results Analysismentioning

confidence: 99%

See 1 more Smart Citation

Research on the Intrusion Detection Method Based on Differentiated Cluster Center Offset Measure

Chen

Nian

2017

MATEC Web Conf.

View full text Add to dashboard Cite

Abstract. In this paper, a kind of local outlier mining method based on differentiated cluster center offset measure is proposed through which the outlier degree of sample can be calculated by use of the normal behavior model constructed by normal data sample and the preset anomaly threshold value, and whether the testing sample belong to intrusion behavior can thus be determined. Furthermore, KDD99 data set is also utilized to test the said method, and the experimental results show that the method proposed in this paper possesses higher detection rate and lower false alarm rate. Key words: Intrusion detection; Anomaly detection; Outlier mining; Cluster center offset OverviewEssentially, the intrusion detection is a classification problem, and the to-be-detected host audit records or network traffic data can be classified as normal behavior or intrusion behavior [1]. Depending on different detection methods, the intrusion detections can be divided into two categories, i.e. anomaly detection and misuse detection. The local outlier mining method studied in this paper belongs to one of such anomaly detection methods.The hypothesis of anomaly detection is that the intruder activity is anomalous to the activity of normal subject [2]. The activity profile of normal activity of the subject can be established according to this concept, and comparisons can be made between the activity status of current subject and the activity profile. When the statistical law is violated, the activity may be considered as an intrusion. The difficult problem for anomaly detection is how to establish the activity profile of normal activity and how to design the statistical algorithm, so that normal operations are not considered as intrusion or the real intrusion behavior are not neglected.Outlier mining technology is very suitable for the completion of anomaly-based intrusion detection. Through the analysis of network data characteristics, two facts can be drawn as below. Firstly, there are significant differences between normal behavior and anomaly behavior. Secondly, in practical applications, the number of anomaly behavior is much lower than that of the normal behavior. In respect of the entire network behavior, intrusion behavior belongs to anomaly data in small numbers, and it can be processed by treating it as outliers in the dataset, which can better reflect the nature of such invasion. At the same time, in respect of other intrusion detection methods, the anomaly detection method based on outlier mining can identify those new categories of attack samples which have not yet appeared [3], which represents the advantage which is not possessed by other detection methods. Therefore, the problem of intrusion detection can be transformed into the outlier mining problem in the network behavior data set. Outlier Mining Method Based on Differentiated Cluster Center Offset MeasureAlthough many outlier mining methods have been proposed in recently-published literature, yet only a few of them are applied to the network anomaly detection. One o...

show abstract

Section: Experiments and Results Analysismentioning

confidence: 99%

“…It can be found by comparison that the detection performance can achieve a better effect if when the value of K is taken close to 8-10. PSO-KM [9] 86 2.8 -SOM [10] 91.5 14.5 -CSI-KNN [11] 91.4 2.6 92.5…”

Section: Experiments and Results Analysismentioning

confidence: 99%

Research on the Intrusion Detection Method Based on Differentiated Cluster Center Offset Measure

Chen

Nian

2017

MATEC Web Conf.

View full text Add to dashboard Cite

show abstract

“…Compared to Toosi and Kahani's study, our ensemble technique that combines all generated models with naïve Bayes provides a better detection rate for U2R, but not for others. Agarwal and Joshi [29] introduced a rule-based framework, Kayacik et al [30] introduced a self-organizing map (SOM)-based technique, and Pfahringer [31] explained the technique, which was the winner of KDD'99, that used a bagged boosting ensemble technique. Our study provides better accuracy results for all types of attacks compared to [27][28][29].…”

Section: Discussionmentioning

confidence: 99%

Modified stacking ensemble approach to detect network intrusion

Demir¹,

Dalkılıç²

2018

Turk J Elec Eng & Comp Sci

View full text Add to dashboard Cite

Detecting intrusions in a network traffic has remained an issue for researchers over the years. Advances in the area of machine learning provide opportunities to researchers to detect network intrusion without using a signature database. We studied and analyzed the performance of a stacking technique, which is an ensemble method that is used to combine different classification models to create a better classifier, on the KDD'99 dataset. In this study, the stacking method is improved by modifying the model generation and selection techniques and by using different classifications algorithms as a combiner method. Model generation is performed using subsets of the dataset with randomly selected features and not all of these models are used as input for the combiner. Various metrics are used in model selection and only selected models are used as input for the combiner method. In our experiments, the stacking technique provided higher accuracy results all the time compared to pure machine learning techniques. The second important result in our experiments was obtaining the highest detection rate for user-to-root attacks compared to other studies.

show abstract

“…All the 41 features of the KDD 99 data set are used in the experiment for classification. H. G. Kayacik, A. N. Zincir-Heywood, and M. I. Heywood [3] have given a detailed description of KDD 99 benchmark dataset. This approach of unsupervised clustering and supervised classification makes the proposed model into a semi supervised learning model.…”

Section: Analysis Of the Effect Of Clustering The Training Data In Namentioning

confidence: 99%

Analysis of the Effect of Clustering the Training Data in Naive Bayes Classifier for Anomaly Network Intrusion Detection

Subramanian¹,

Ong²

2014

JACN

View full text Add to dashboard Cite

Abstract-This paper presents the analysis of the effect of clustering the training data and test data in classification efficiency of Naive Bayes classifier. KDD cup 99 benchmark dataset is used in this research. The training set is clustered using k means clustering algorithm into 5 clusters. Then 8800 samples are taken from the clusters to form the training and test set. The results are compared with that of two Naive Bayes classifiers trained on random sampled data containing 8800 and 17600 instances respectively. The main contribution of this paper is that it is empirically proved that the training set derived from clusters generated by k-means clustering algorithm improves the classification efficiency of the Naive Bayes classifier. The results show the accuracy of the Naive Bayes classifier trained with clustered instances is 94.4% while that of normal instances are 85.41% and 89.26%.

show abstract

On the capability of an SOM based intrusion detection system

Cited by 104 publications

References 5 publications

Research on the Intrusion Detection Method Based on Differentiated Cluster Center Offset Measure

Research on the Intrusion Detection Method Based on Differentiated Cluster Center Offset Measure

Modified stacking ensemble approach to detect network intrusion

Analysis of the Effect of Clustering the Training Data in Naive Bayes Classifier for Anomaly Network Intrusion Detection

Contact Info

Product

Resources

About