Unsupervised Anomaly Detection Based on Clustering and Multiple One-Class SVM

Song, Jungsuk; Takakura, Hiroki; Okabe, Yasuo; Kwon, Yongjin

doi:10.1587/transcom.e92.b.1981

Cited by 32 publications

(18 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To this end, we first collected raw traffic data from our honeypots (Song et al, 2008c), and we extracted 14 statistical features (Benchmark Data, 2010;Song et al, 2009) from them as described in subsection 4.1. We also captured IDS alerts that were recorded by Snort (ver.…”

Section: Resultsmentioning

confidence: 99%

“…The proposed algorithm improves the detection accuracy and reduce the false positive rate by overcoming shortcomings of the K-means in intrusion detection. Also, Song, et al proposed a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate (Song et al, 2009). …”

Section: Intrusion Detection Using Raw Traffic Datamentioning

confidence: 99%

“…During the last decade, many machine learning and data mining techniques have been applied to IDSs, so that their performance was significantly improved as well as they could be constructed with low cost and effort. Particularly, unsupervised anomaly detection techniques (Eskin et al, 2002;Guan et al, 2003;Laskov et al, 2004;Leung & Leckie, 2005;Li et al, 2003;Oldmeadow et al, 2004;Portnoy et al, 2001;Song et al, 2008a;2009;Wang & Megalooikonomou, 2005) have received remarkable attention, because they are able to construct intrusion detection models without using any labeled training data (i.e., with Jungsuk Song 1 , Hiroki Takakura 2 , Yasuo Okabe 3 and Yongjin Kwon 4 instances preclassified as being an attack or not) in an automated manner, and they also have intrinsic ability to detect 0-day attacks. Furthermore, considering labeled data or purely normal data cannot be obtained easily in practice, it is better to focus on applying unsupervised anomaly detection techniques to the construction of IDSs than supervised ones.…”

Section: Introductionmentioning

confidence: 99%

“…In this chapter, we conduct correlation analysis between raw traffic data and IDS alerts using one-class SVM (Li et al, 2003;Schölkopf et al, 2001), focusing on evaluation of unsupervised anomaly detection, which is one of the most general and powerful unsupervised machine learning technique. To this end, we first collected raw traffic data from our honeypots deployed in Kyoto University (Song et al, 2008c), and we extracted 14 statistical features (Benchmark Data, 2010;Song et al, 2009) from them. We also obtained IDS alerts that were recorded by Snort (ver.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Correlation Analysis Between Honeypot Data and IDS Alerts Using One-class SVM

Song¹,

Takakura²,

Okabe³

et al. 2011

Intrusion Detection Systems

Self Cite

View full text Add to dashboard Cite

Section: Resultsmentioning

confidence: 99%

Section: Intrusion Detection Using Raw Traffic Datamentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Correlation Analysis Between Honeypot Data and IDS Alerts Using One-class SVM

Song¹,

Takakura²,

Okabe³

et al. 2011

Intrusion Detection Systems

Self Cite

View full text Add to dashboard Cite

“…Unsupervised Anomaly Detection System [21] is based on clustering and multiple one-class SVM to detect 0-day attacks and to improve the detection rate while maintaining a low false positive rate. It is able to construct intrusion detection models automatically without using labeled training data.…”

Section: Related Workmentioning

confidence: 99%

A Hybrid Real-time Zero-day Attack Detection and Analysis System

Kaur

Singh²

2015

IJCNIS

View full text Add to dashboard Cite

Abstract-A zero-day attack poses a serious threat to the Internet security as it exploits zero-day vulnerabilities in the computer systems. Attackers take advantage of the unknown nature of zero-day exploits and use them in conjunction with highly sophisticated and targeted attacks to achieve stealthiness with respect to standard intrusion detection techniques. Thus, it's difficult to defend against such attacks. Present research exhibits various issues and is not able to provide complete solution for the detection and analysis of zero-day attacks. This paper presents a novel hybrid system that integrates anomaly, behavior and signature based techniques for detecting and analyzing zero-day attacks in real-time. It has layered and modular design which helps to achieve high performance, flexibility and scalability. The system is implemented and evaluated against various standard metrics like True Positive Rate (TPR), False Positive Rate (FPR), FMeasure, Total Accuracy (ACC) and Receiver Operating Characteristic (ROC) curve. The result shows high detection rate with nearly zero false positives. Additionally, the proposed system is compared with Honeynet system.

show abstract

Ensemble approach for network threat detection and classification on cloud computing

Krishnaveni¹,

Prabakaran

2019

Concurrency and Computation

View full text Add to dashboard Cite

Summary As Network traffic rises and attacks become more widespread and complicated, we must come across Innovative ways to enrich Intrusion Detection Systems in Cloud Computing. This paper proposes the Ensemble approaches for Network Intrusion Detection and Classification in Cloud. The major aids of the Ensemble Learning to improve the outcome of each Machine Learning Algorithms and to get a robust Classifier. Real Time Malicious Network Streams Samples were collected using Honeynet, which is deployed on cloud environment. We use supervised learning and Unsupervised learning algorithms for classifying the known malicious network streams and unknown malicious streams. Network related attacks can be segregated into four classes, namely, Denial of service (DOS), User to root (U2 R), Remote to local (R2L), and probe, and the vital constraints that must be overcome with the end goal to build efficient Intelligent Intrusion Detection. The motivation behind the proposed work is to enhance the accuracy rate with response time. The outcome obtained from the Ensemble method has better accuracy rate compared to the SVM, Naive Bayes, and Logistic regression method.

show abstract

Unsupervised Anomaly Detection Based on Clustering and Multiple One-Class SVM

Cited by 32 publications

References 17 publications

Correlation Analysis Between Honeypot Data and IDS Alerts Using One-class SVM

Correlation Analysis Between Honeypot Data and IDS Alerts Using One-class SVM

A Hybrid Real-time Zero-day Attack Detection and Analysis System

Ensemble approach for network threat detection and classification on cloud computing

Contact Info

Product

Resources

About