A real time unsupervised NIDS for detecting unknown and encrypted network attacks in high speed network

Amoli, Payam Vahdani; Hämäläinen, Timo D.

doi:10.1109/iwmn.2013.6663794

Cited by 19 publications

(12 citation statements)

References 59 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Typical algorithms for supervised learning include support vector machines, neural networks, Bayesian algorithms, and decision trees. The training samples of unsupervised learning [54] need not be labeled, and samples with similar characteristics are determined to be in the same class in the learning process. Unsupervised learning algorithms include K-NN, K-means, GMM, HMM, and other clustering algorithms.…”

Section: ) Traffic Classification Methods Based On Machine Learningmentioning

confidence: 99%

A Survey of Privacy Protection and Network Security in User On-Demand Anonymous Communication

et al. 2020

View full text Add to dashboard Cite

In an untrusted Internet environment, there is a large amount of user privacy information being vulnerable to various attacks, and it is an important security concern for users on how to protect their privacy, and to further provide the anonymity guarantee. Recently, most privacy-sensitive users prefer anonymous communication to protect their private information from eavesdropping by attackers. Each user has different privacy protection demands for anonymous communication. However, anonymous communication methods cannot meet the various anonymity needs of users. Hence, the user on-demand anonymous communication is proposed, which can dynamically adjust the anonymity level according to a user's anonymity needs. However, the defense capabilities against attacks are insufficient in the existing user on-demand anonymous communication. Some malicious users in the network employ anonymous communication to hide their identities and attack the Internet. Moreover, the existing user on-demand anonymous communication is weak against traffic classification attacks based on machine learning. Therefore, this paper investigates its progresses and defects in privacy protection and network security. User on-demand anonymous communication is mainly composed of the user side and the transmission side. We separately investigate privacy protection and network security of user on-demand anonymous communication from the user side and the transmission side. By surveying various identity anonymity of users on the user side and the hierarchical anonymous transmission on the transmission side, we find two kinds of serious attacks in user on-demand anonymous communication, i.e., abuse of anonymous communication and traffic classification attacks based on machine learning. To solve the above security issues, we suggest the balancing mechanism of anonymous communication and behavior tracking which is used to prevent anonymous abuse, and the secure defense mechanism which is used to resist traffic classification attacks. To inspire follow-up research, we identify some open problems and emphasize future trends concerning user on-demand anonymous communication. INDEX TERMS Privacy protection, network security, machine learning, traffic classification attacks, user on-demand anonymous communication.

show abstract

Section: ) Traffic Classification Methods Based On Machine Learningmentioning

confidence: 99%

A Survey of Privacy Protection and Network Security in User On-Demand Anonymous Communication

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Amoli and Hamalainen described a Network Intrusion Detection System (NIDS) capable of detecting attacks in encrypted network traffic in real time. The NIDS has two engines; the first one uses network change measurement to detect changes in a time series, such as denial of service and distributed denial of service.…”

Section: Feature‐based Traffic Classification Techniques For Encryptementioning

confidence: 99%

A survey of methods for encrypted traffic classification and analysis

et al. 2015

View full text Add to dashboard Cite

Summary With the widespread use of encrypted data transport, network traffic encryption is becoming a standard nowadays. This presents a challenge for traffic measurement, especially for analysis and anomaly detection methods, which are dependent on the type of network traffic. In this paper, we survey existing approaches for classification and analysis of encrypted traffic. First, we describe the most widespread encryption protocols used throughout the Internet. We show that the initiation of an encrypted connection and the protocol structure give away much information for encrypted traffic classification and analysis. Then, we survey payload and feature‐based classification methods for encrypted traffic and categorize them using an established taxonomy. The advantage of some of described classification methods is the ability to recognize the encrypted application protocol in addition to the encryption protocol. Finally, we make a comprehensive comparison of the surveyed feature‐based classification methods and present their weaknesses and strengths. Copyright © 2015 John Wiley & Sons, Ltd.

show abstract

“…Authors in [11] proposed a new real time and unsupervised network intrusion detection system. It detects new and complex attacks within normal and encrypted communications.…”

Section: Related Workmentioning

confidence: 99%

Applicability of clustering techniques on masquerade detection

Raveendran¹,

Dhanya²

2014

2014 International Conference on Advances in Computing, Communications and Informatics (ICACCI)

View full text Add to dashboard Cite

In masquerade attack, attacker impersonates legitimate user. Most of the masquerade detection techniques done so far are based on supervised learning techniques. But here in this paper masquerade detection based on unsupervised learning techniques are used. Various clustering algorithms used are K-Means, K-Medoid, Agglomerative clustering algorithm and DBSCAN. A comparative study is done based on the detection capability of these four clustering algorithms. The experiment is conducted on Schonlau data set [1]. From the experiment it was found that K-Medoid algorithm, agglomerative clustering algorithm and DBSCAN algorithm outperforms K-means clustering.

show abstract

A real time unsupervised NIDS for detecting unknown and encrypted network attacks in high speed network

Cited by 19 publications

References 59 publications

A Survey of Privacy Protection and Network Security in User On-Demand Anonymous Communication

A Survey of Privacy Protection and Network Security in User On-Demand Anonymous Communication

A survey of methods for encrypted traffic classification and analysis

Applicability of clustering techniques on masquerade detection

Contact Info

Product

Resources

About