Unsupervised Anomaly Detection with Unlabeled Data Using Clustering
Intrusions pose a serious security risk in a network environment. New intrusion types, of which detection systems are unaware, are the most difficult to detect. The amount of available network audit data instances is usually large; human labeling is tedious, time-consuming, and expensive. Traditiona...
Saved in:
| Main Authors: | , , |
|---|---|
| Format: | Conference or Workshop Item |
| Language: | en |
| Published: |
2005
|
| Subjects: | |
| Online Access: | http://eprints.utm.my/3356/1/Mohd_Noor_-_Unsupervised_Anomaly_Detection_with_Unlabeled_Data.pdf http://eprints.utm.my/3356/ |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Summary: | Intrusions pose a serious security risk in a network environment. New intrusion types, of which detection systems are unaware, are the most difficult to detect. The amount of available network audit data instances is usually large; human labeling is tedious, time-consuming, and expensive. Traditional anomaly detection algorithms require a set of purely normal data from which they train their model. We present a clustering-based intrusion detection algorithm, unsupervised anomaly detection, which trains on unlabeled data in order to detect new intrusions. Our method is able to detect many different types of intrusions, while maintaining a low false positive rate as verified over the Knowledge Discovery and Data Mining - KDD CUP 1999 dataset. |
|---|