Autonomic intrusion detection: Adaptively detecting anomalies over unlabeled audit data streams in computer networks

Abstract

In this work, we propose a novel framework of autonomic intrusion detection that fulfills online and adaptive intrusion detection over unlabeled HTTP traffic streams in computer networks. The framework holds potential for self-managing: self-labeling, self-updating and self-adapting. Our framework employs the Affinity Propagation (AP) algorithm to learn a subject's behaviors through dynamical clustering of the streaming data. It automatically labels the data and adapts to normal behavior changes while identifies anomalies. Two large real HTTP traffic streams collected in our institute as well as a set of benchmark KDD'99 data are used to validate the framework and the method. The test results show that the autonomic model achieves better results in terms of effectiveness and efficiency compared to adaptive Sequential Karhunen-Loeve method and static AP as well as three other static anomaly detection methods, namely k-NN, PCA and SVM.

Human error tolerant anomaly detection based on time-periodic packet sampling

“…In both the ls-and sl-methods, the extracted traffic data is used for training a baseline model. Although some auto-labeling techniques based on machine learning theory [21] can be also used to correct/prevent human errors, such techniques needs higher processing cost than time-periodic packet sampling. The proposed methods in this paper enable us to correct/prevent human errors with lower processing cost.…”

A Fusion of Multiagent Functionalities for Effective Intrusion Detection System

“…The analysis of subject behavior over the unlabeled HTTP streams is required in IDS. Wang et al [22] employed Affinity Propagation (AP) algorithm to learn the subject's behavior in dynamic clustering. The data classification, human interaction, deficiency in labeled data were the important issues in NIDS.…”

An adaptive system for detecting malicious queries in web attacks

“…Since attackers have become more sophisticated and utilized more advanced web attack toolkits, the detection model might become obsolete and outdated, incapable of detecting the latest malicious queries in web attacks. Previous adaptive attack detection methods [16][17][18] are designed for network intrusions and are not applicable to web attacks. A practical solution for keeping the web attack detection model constantly updated is to incorporate the latest important queries, including informative benign queries and representative malicious queries.…”