Evolutionary Optimization on Misuse and Anomaly IDS Using LOF-based Clustering
Date Issued
2006
Date
2006
Author(s)
Chen, Chun-Hao
DOI
en-US
Abstract
With wide application of internet, various attack techniques have been developed and threaten the e-society. Old passive safeguard, e.g. firewall, and password, is insufficient when the attack techniques progress continuously. Hence, intrusion detection system (IDS) is developed for active protection. Using data mining technique to develop IDS is automatic and effective; therefore it can replace traditional signature-based IDS. IDS can be classified into misuse detection and anomaly detection. Misuse detection uses those patterns of known attacks to match and identify intrusions. Anomaly detection constructs normal behavior profiles to detect attacks.
This thesis proposes an IDS both for misuse detection and anomaly detection. We extend an excellent outlier detection algorithm LOF to a clustering algorithm. LOF can detect some outliers that other algorithms can not detect. Though there are several common concepts between outlier detection and clustering, the original LOF algorithm can not explicitly form clusters. We make extension to it and apply to IDS. The part of clustering can build the information of training data and find the association between training data and testing data; and the part of outlier detection can detect the unseen attacks if the data deviate from the distribution of training data. Besides, a genetic algorithm is used to assign each feature of data an importance (weight), and generate several sets of weights in terms of characteristics of each attack type. This is adopted to raise the accuracy of IDS. In experiments, the KDD Cup 1999 data is used to evaluate our system. We get good results both for misuse detection and anomaly detection.
Subjects
入侵偵測系統
叢集分析
孤立點偵測
基因演算法
資料探勘
IDS
clustering
outlier detection
GA
data mining
Type
thesis
File(s)![Thumbnail Image]()
Loading...
Name
ntu-95-R93922101-1.pdf
Size
23.31 KB
Format
Adobe PDF
Checksum
(MD5):31be3e40e3e45586a156d36009d50311