Local outlier factor and stronger one class classifier based hierarchical model for detection of attacks in network intrusion detection dataset  

作　　者：Alampallam Ramaswamy VASUDEVAN Subramanian SELVAKUMAR 

机构地区：[1]CDBR-SSE Lab, Department of Computer Science and Engineering, National Institute of Technology, Tiruchirappalli (NITT), Tiruchirappalli 620015, India

出　　处：《Frontiers of Computer Science》2016年第4期755-766,共12页中国计算机科学前沿（英文版）

摘　　要：Identification of attacks by a network intrusion detection system （NIDS） is an important task. In signature or rule based detection, the previously encountered attacks are modded, and signatures/rules are extracted. These rules are used to detect such attacks in future, but in anomaly or outlier detection system, the normal network traffic is modeled. Any deviation from the normal model is deemed to be an outlier/attack. Data mining and machine learning techniques are widely used in offline NIDS. Unsupervised and supervised learning techniques differ the way NIDS dataset is treated. The characteristic features of unsupervised and supervised learning are finding patterns in data, detecting outliers, and determining a learned function for input features, generalizing the data instances respectively. The intuition is that if these two techniques are combined, better performance may be obtained. Hence, in this paper the advantages of unsupervised and supervised techniques are inherited in the proposed hierarchical model and devised into three stages to detect attacks in NIDS dataset. NIDS dataset is clustered using Dirichiet process （DP） clustering based on the underlying data distribution. Iteratively on each cluster, local denser areas are identified using local outlier factor （LOF） which in turn is discretized into four bins of separation based on LOF score. Further, in each bin the normal data instances are modeled using one class classifier （OCC）. A combination of Density Estimation method, Reconstruction method, and Boundary methods are used for OCC model. A product rule combination of the three methods takes into consideration the strengths of each method in building a stronger OCC model. Any deviation from this model is considered as an attack. Experiments are conducted on KDD CUP＇99 and SSENet-2011 datasets. The results show that the proposed model is able to identify attacks with higher detection rate and low false alarms.Identification of attacks by a network intrusion detection system （NIDS） is an important task. In signature or rule based detection, the previously encountered attacks are modded, and signatures/rules are extracted. These rules are used to detect such attacks in future, but in anomaly or outlier detection system, the normal network traffic is modeled. Any deviation from the normal model is deemed to be an outlier/attack. Data mining and machine learning techniques are widely used in offline NIDS. Unsupervised and supervised learning techniques differ the way NIDS dataset is treated. The characteristic features of unsupervised and supervised learning are finding patterns in data, detecting outliers, and determining a learned function for input features, generalizing the data instances respectively. The intuition is that if these two techniques are combined, better performance may be obtained. Hence, in this paper the advantages of unsupervised and supervised techniques are inherited in the proposed hierarchical model and devised into three stages to detect attacks in NIDS dataset. NIDS dataset is clustered using Dirichiet process （DP） clustering based on the underlying data distribution. Iteratively on each cluster, local denser areas are identified using local outlier factor （LOF） which in turn is discretized into four bins of separation based on LOF score. Further, in each bin the normal data instances are modeled using one class classifier （OCC）. A combination of Density Estimation method, Reconstruction method, and Boundary methods are used for OCC model. A product rule combination of the three methods takes into consideration the strengths of each method in building a stronger OCC model. Any deviation from this model is considered as an attack. Experiments are conducted on KDD CUP＇99 and SSENet-2011 datasets. The results show that the proposed model is able to identify attacks with higher detection rate and low false alarms.

关 键 词：hierarchical model DP clustering LOF Dis-cretizer one class classifier NIDS 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP311.13[自动化与计算机技术—计算机科学与技术]