A clustering-based method for unsupervised intrusion detections

Jiang, Shengyi; Song, Xiaoyu; Wang, Hui; Han, Jian-Jun; Li, Qinghua

doi:10.1016/j.patrec.2005.11.007

Cited by 133 publications

(43 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…From a similar perspective, (Qiao et al 2012) proposes a two-stage clustering algorithm to analyze the spatial and temporal relation of the network intrusion behaviors' alert sequence. (Jiang et al 2006) describes a classification of network traces through an improved nearest neighbor method, while (Cui and Ieee 2012) applies data mining algorithms for the same purpose and the results of preformatted data are visually displayed. (Ge and Zhang 2012) discusses on how the clustering algorithm is applied to intrusion detection and analyses intrusion detection algorithm based on clustering problems.…”

Section: Related Previous Workmentioning

confidence: 99%

Visualization and Clustering for SNMP Intrusion Detection

Herrero

Corchado

2013

Cybernetics and Systems

View full text Add to dashboard Cite

Abstract. Accurate intrusion detection still is an open challenge. Present work aims at being one step towards that purpose by studying the combination of clustering and visualization techniques. To do that, MOVICAB-IDS, previously proposed as a hybrid intelligent Intrusion Detection System (IDS) based on visualization techniques, is upgraded by adding automatic response thanks to clustering methods. To check the validity of the proposed clustering extension, it has been applied to the identification of different anomalous situations related to the SNMP network protocol by using real-life data sets. Different ways of applying neural projection and clustering techniques are studied in present work. Through the experimental validation it is shown that the proposed techniques could be compatible and consequently applied to a continuous network flow for intrusion detection.

show abstract

Section: Related Previous Workmentioning

confidence: 99%

Visualization and Clustering for SNMP Intrusion Detection

Herrero

Corchado

2013

Cybernetics and Systems

View full text Add to dashboard Cite

show abstract

“…Xian et al [9] proposed to unite fuzzy KNN algorithm with clonal selection algorithm to design network intrusion detection. Jiang et al [10] used incremental KNN algorithm to detect intrusions. Authors used outlier factor to calculate the deviation degree of the cluster in this work.…”

Section: Literature Reviewmentioning

confidence: 99%

Network Intrusion Detection System using Apache Storm

Manzoor¹,

Morgan²

2017

Adv. sci. technol. eng. syst. j.

View full text Add to dashboard Cite

show abstract

“…Generally, a learning algorithm of this model generates f (x) by learning from all instances except the test instance, for example from v, w, y, and z represented by learning connections (dash lines). Many algorithms from recent studies learn from an entire data set [12] or require a certain amount of data [13] before detecting an individual or group of test instances are classified under "batch model" as well. However, this model is more suitable for an offline system rather than for a real-time system because in a real-time system we cannot acquire any information from instances that occur after the present instance.…”

Section: Related Work and Our Proposed Modelmentioning

confidence: 99%

Unsupervised Learning Model for Real-Time Anomaly Detection in Computer Networks

Limthong

Fukuda

et al. 2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYDetecting a variety of anomalies caused by attacks or accidents in computer networks has been one of the real challenges for both researchers and network operators. An effective technique that could quickly and accurately detect a wide range of anomalies would be able to prevent serious consequences for system security or reliability. In this article, we characterize detection techniques on the basis of learning models and propose an unsupervised learning model for real-time anomaly detection in computer networks. We also conducted a series of experiments to examine capabilities of the proposed model by employing three well-known machine learning algorithms, namely multivariate normal distribution, knearest neighbor, and one-class support vector machine. The results of these experiments on real network traffic suggest that the proposed model is a promising solution and has a number of flexible capabilities to detect several types of anomalies in real time. key words: machine learning, multivariate normal distribution, nearest neighbor, one-class support vector machine

show abstract

A clustering-based method for unsupervised intrusion detections

Cited by 133 publications

References 9 publications

Visualization and Clustering for SNMP Intrusion Detection

Visualization and Clustering for SNMP Intrusion Detection

Network Intrusion Detection System using Apache Storm

Unsupervised Learning Model for Real-Time Anomaly Detection in Computer Networks

Contact Info

Product

Resources

About