Abstract | ||
---|---|---|
Anomaly detection is a method for determining behaviors which do not accord with normal ones. It is mostly used for detecting abnormal behaviors, mutational and unknown attacks. In this paper, we propose a technique that generates patterns about network-based normal behaviors in blocks of a TCP network session for the anomaly detection. One session is expressed as one pattern based on a stream of the packets in the session, and thus the pattern we generate has a sequential feature. We use the ROCK algorithm to cluster the sequence patterns which have categorical attributes. This algorithm performs clustering based on our similarity function which uses Dynamic Programming. The many sequence patterns of the normal behaviors can be reduced to several representative sequence patterns using the clustering. Our detecting sensor uses profiling dataset that are constructed by the representative sequence patterns of normal behaviors. We show the effectiveness of proposed model by using results from the 1999 DARPA Intrusion Detection Evaluation. |
Year | DOI | Venue |
---|---|---|
2006 | 10.1007/11751588_37 | ICCSA |
Keywords | Field | DocType |
anomaly detection,normal behavior,network anomaly detection,abnormal behavior,tcp network session,representative sequence pattern,network-based normal behavior,darpa intrusion detection evaluation,rock algorithm,sequence pattern,dynamic programming,intrusion detection | Anomaly detection,Computer science,Categorical variable,Profiling (computer programming),Computer security,Computer network,Transmission Control Protocol,Artificial intelligence,Cluster analysis,Intrusion detection system,Dynamic programming,Pattern recognition,Network packet | Conference |
Volume | ISSN | ISBN |
3981 | 0302-9743 | 3-540-34072-6 |
Citations | PageRank | References |
1 | 0.49 | 6 |
Authors | ||
4 |
Name | Order | Citations | PageRank |
---|---|---|---|
Sang-Kyun Noh | 1 | 20 | 2.36 |
Yong-Min Kim | 2 | 8 | 3.01 |
DongKook Kim | 3 | 6 | 2.89 |
Bong-Nam Noh | 4 | 68 | 14.75 |