Intrusion Detection System Using Multivariate Control Chart Hotelling's T2 Based on PCA

Abstract

Statistical Process Control (SPC) has been widely used in industry and services. The SPC can be applied not only to monitor manufacture processes but also can be applied to the Intrusion Detection System (IDS). In network monitoring and intrusion detection, SPC can be a powerful tool to ensure system security and stability in a network. Theoretically, Hotelling's T 2 chart can be used in intrusion detection. However, there are two reasons why the chart is not suitable to be used. First, the intrusion detection data involves large volumes of high-dimensional process data. Second, intrusion detection requires a fast computational process so an intrusion can be detected as soon as possible. To overcome the problems caused by large number of quality characteristics, Principal Component Analysis (PCA) can be used. The PCA can reduce not only the dimension leading a faster computational, but also can eliminate the multicollinearity (among characteristic variables) problem. This paper is focused on the usage of multivariate control chart T 2 based on PCA for IDS. KDD99 dataset is used to evaluate the performance of the proposed method. Furthermore, the performance of T 2 based PCA will be compared with conventional T 2 control chart. The empirical results of this research show that the multivariate control chart using Hotelling's T 2 based on PCA has excellent performance to detect anomaly in network. Compared to conventional T 2 control chart, the T 2 based on PCA has similar performance with 97 percent hit rate. It also requires shorter computation time.

The effectiveness of Max‐half‐Mchart over Max‐Mchart in simultaneously monitoring process mean and variability of individual observations

“…Khoo 30 1) and ( 5) to monitor the process mean and process variability, respectively. A single chart to monitor both process mean and process variability needs transformation to obtain statistics for the process location and variability, respectively, as formulated in Equations ( 7) and (8) followed by calculation in Equation (9).…”

“…Hence, when it is transformed to the quantile of the standard normal distribution, it produces a large negative value. The absolute value of this large negative score will raise strong signals and will be selected as a single statistic in the Max-Mchart, as formulated in Equation (9). This empirical fact causes either an inaccurate in-control/out-of-control conclusion as in Figure 3 on the 16-th and 32-nd samples or inconsistency pattern on the 54-th, 55-th, and 56-th samples.…”

“…The Hotelling's 2 is a conventional control chart used for monitoring the mean vector. The literature comprises several studies on the Hotelling's 2 control chart, including Sullivan and Woodall, 1 Vargas, 2 Chen and Hsieh, 3 Alfaro and Ortega, 4 Yahaya et al, 5 Chattinnawat and Bilen, 6 Haddad and Alsmadi, 7 Vives-Mestres et al, 8 Ahsan et al, 9 and Khatun et al 10 A few control charts have also been developed to monitor covariance matrices. One of them is the generalized variance (GV) control chart by Anderson.…”

Triple Modular Redundancy Optimization for Threshold Determination in Intrusion Detection Systems

“…It uses an entropy and hybrid approach to prevent attackers into training models and tricking them that attack traffic is a regular one. Multiple fields have been observed from network traffic to achieve the best possible result but in [26] we find an explanation of the attempt to use the statistical process control applied in the IDS where principal component analysis is used to overcome the problems caused by a big number of quality characteristics.…”

Max-Half-Mchart: A Simultaneous Control Chart Using a Half-Normal Distribution for Subgroup Observations

“…Khusna et al [19] proposed the bootstrap for Max-MCUSUM for autocorrelated data. Ahsan et al [20] also built a control limit in the T 2 control chart for detection instructions. The Bootstrap control limit for conventional Max-Mchart was also developed by Kruba et al [21] when monitoring fertilizer.…”