An autonomous labeling approach to support vector machines algorithms for network traffic anomaly detection
| Autor: | Carlos Catania, Facundo Bromberg, Carlos García Garino |
|---|---|
| Rok vydání: | 2012 |
| Předmět: |
Anomaly-based intrusion detection system
business.industry Computer science General Engineering Process (computing) Intrusion detection system Machine learning computer.software_genre Novelty detection Class (biology) Field (computer science) Computer Science Applications Support vector machine Artificial Intelligence Anomaly detection Data mining Artificial intelligence business computer Algorithm |
| Zdroj: | Expert Systems with Applications. 39:1822-1829 |
| ISSN: | 0957-4174 |
| DOI: | 10.1016/j.eswa.2011.08.068 |
| Popis: | In the past years, several support vector machines (SVM) novelty detection approaches have been applied on the network intrusion detection field. The main advantage of these approaches is that they can characterize normal traffic even when trained with datasets containing not only normal traffic but also a number of attacks. Unfortunately, these algorithms seem to be accurate only when the normal traffic vastly outnumbers the number of attacks present in the dataset. A situation which can not be always hold. This work presents an approach for autonomous labeling of normal traffic as a way of dealing with situations where class distribution does not present the imbalance required for SVM algorithms. In this case, the autonomous labeling process is made by SNORT, a misuse-based intrusion detection system. Experiments conducted on the 1998 DARPA dataset show that the use of the proposed autonomous labeling approach not only outperforms existing SVM alternatives but also, under some attack distributions, obtains improvements over SNORT itself. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full Text from ScienceDirect