Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload

Intrusion Detection System (IDS) in general considers a big amount of data that are highly redundant and irrelevant. This trait causes slow instruction, assessment procedures, high resource consumption and poor detection rate. Due to their expensive computational requirements during both training an...

Full description

Saved in:
Bibliographic Details
Main Authors: Kakavand, Mohsen, Mustapha, Norwati, Mustapha, Aida, Abdullah @ Selimun, Mohd Taufik
Format: Article
Language:English
Published: Korean Society for Internet Information 2016
Online Access:http://psasir.upm.edu.my/id/eprint/54067/1/Effective%20dimensionality%20reduction%20of%20payload-based%20anomaly%20detection%20in%20TMAD%20model%20for%20HTTP%20payload.pdf
http://psasir.upm.edu.my/id/eprint/54067/
http://itiis.org/digital-library/manuscript/1437
Tags: Add Tag
No Tags, Be the first to tag this record!
id my.upm.eprints.54067
record_format eprints
spelling my.upm.eprints.540672018-02-27T04:28:36Z http://psasir.upm.edu.my/id/eprint/54067/ Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload Kakavand, Mohsen Mustapha, Norwati Mustapha, Aida Abdullah @ Selimun, Mohd Taufik Intrusion Detection System (IDS) in general considers a big amount of data that are highly redundant and irrelevant. This trait causes slow instruction, assessment procedures, high resource consumption and poor detection rate. Due to their expensive computational requirements during both training and detection, IDSs are mostly ineffective for real-time anomaly detection. This paper proposes a dimensionality reduction technique that is able to enhance the performance of IDSs up to constant time O(1) based on the Principle Component Analysis (PCA). Furthermore, the present study offers a feature selection approach for identifying major components in real time. The PCA algorithm transforms high-dimensional feature vectors into a low-dimensional feature space, which is used to determine the optimum volume of factors. The proposed approach was assessed using HTTP packet payload of ISCX 2012 IDS and DARPA 1999 dataset. The experimental outcome demonstrated that our proposed anomaly detection achieved promising results with 97% detection rate with 1.2% false positive rate for ISCX 2012 dataset and 100% detection rate with 0.06% false positive rate for DARPA 1999 dataset. Our proposed anomaly detection also achieved comparable performance in terms of computational complexity when compared to three state-of-the-art anomaly detection systems. Korean Society for Internet Information 2016-08 Article PeerReviewed text en http://psasir.upm.edu.my/id/eprint/54067/1/Effective%20dimensionality%20reduction%20of%20payload-based%20anomaly%20detection%20in%20TMAD%20model%20for%20HTTP%20payload.pdf Kakavand, Mohsen and Mustapha, Norwati and Mustapha, Aida and Abdullah @ Selimun, Mohd Taufik (2016) Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload. KSII Transactions on Internet and Information Systems, 10 (8). pp. 1-27. ISSN 1976-7277 http://itiis.org/digital-library/manuscript/1437 10.3837/tiis.2016.08.025
institution Universiti Putra Malaysia
building UPM Library
collection Institutional Repository
continent Asia
country Malaysia
content_provider Universiti Putra Malaysia
content_source UPM Institutional Repository
url_provider http://psasir.upm.edu.my/
language English
description Intrusion Detection System (IDS) in general considers a big amount of data that are highly redundant and irrelevant. This trait causes slow instruction, assessment procedures, high resource consumption and poor detection rate. Due to their expensive computational requirements during both training and detection, IDSs are mostly ineffective for real-time anomaly detection. This paper proposes a dimensionality reduction technique that is able to enhance the performance of IDSs up to constant time O(1) based on the Principle Component Analysis (PCA). Furthermore, the present study offers a feature selection approach for identifying major components in real time. The PCA algorithm transforms high-dimensional feature vectors into a low-dimensional feature space, which is used to determine the optimum volume of factors. The proposed approach was assessed using HTTP packet payload of ISCX 2012 IDS and DARPA 1999 dataset. The experimental outcome demonstrated that our proposed anomaly detection achieved promising results with 97% detection rate with 1.2% false positive rate for ISCX 2012 dataset and 100% detection rate with 0.06% false positive rate for DARPA 1999 dataset. Our proposed anomaly detection also achieved comparable performance in terms of computational complexity when compared to three state-of-the-art anomaly detection systems.
format Article
author Kakavand, Mohsen
Mustapha, Norwati
Mustapha, Aida
Abdullah @ Selimun, Mohd Taufik
spellingShingle Kakavand, Mohsen
Mustapha, Norwati
Mustapha, Aida
Abdullah @ Selimun, Mohd Taufik
Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload
author_facet Kakavand, Mohsen
Mustapha, Norwati
Mustapha, Aida
Abdullah @ Selimun, Mohd Taufik
author_sort Kakavand, Mohsen
title Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload
title_short Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload
title_full Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload
title_fullStr Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload
title_full_unstemmed Effective dimensionality reduction of payload-based anomaly detection in TMAD model for HTTP payload
title_sort effective dimensionality reduction of payload-based anomaly detection in tmad model for http payload
publisher Korean Society for Internet Information
publishDate 2016
url http://psasir.upm.edu.my/id/eprint/54067/1/Effective%20dimensionality%20reduction%20of%20payload-based%20anomaly%20detection%20in%20TMAD%20model%20for%20HTTP%20payload.pdf
http://psasir.upm.edu.my/id/eprint/54067/
http://itiis.org/digital-library/manuscript/1437
_version_ 1643835556071735296
score 13.160551