Autonomic Intrusion Detection: Adaptively Detecting Anomalies over Unlabeled Audit Data Streams in Computer Networks

Wei Wang 1 Thomas Guyet 2, 3 René Quiniou 2 Marie-Odile Cordier 2 Florent Masseglia 4 Xiangliang Zhang 5
2 DREAM - Diagnosing, Recommending Actions and Modelling
Inria Rennes – Bretagne Atlantique , IRISA-D7 - GESTION DES DONNÉES ET DE LA CONNAISSANCE
4 ZENITH - Scientific Data Management
LIRMM - Laboratoire d'Informatique de Robotique et de Microélectronique de Montpellier, CRISAM - Inria Sophia Antipolis - Méditerranée
Abstract : In this work, we propose a novel framework of autonomic intrusion detection that fulfills online and adaptive intrusion detection over unlabeled HTTP traffic streams in computer networks. The framework holds potential for self-managing: self-labeling, self-updating and self-adapting. Our framework employs the Affinity Propagation (AP) algorithm to learn a subject's behaviors through dynamical clustering of the streaming data. It automatically labels the data and adapts to normal behavior changes while identifies anomalies. Two large real HTTP traffic streams collected in our institute as well as a set of benchmark KDD'99 data are used to validate the framework and the method. The test results show that the autonomic model achieves better results in terms of effectiveness and efficiency compared to adaptive Sequential Karhunen-Loeve method and static AP as well as three other static anomaly detection methods, namely k-NN, PCA and SVM.
Complete list of metadatas

Cited literature [55 references]  Display  Hide  Download

https://hal.inria.fr/hal-01052810
Contributor : René Quiniou <>
Submitted on : Sunday, July 21, 2019 - 5:54:56 PM
Last modification on : Tuesday, July 23, 2019 - 1:17:21 AM

File

KBS-Autonomic%20Intrusion%20De...
Files produced by the author(s)

Identifiers

Citation

Wei Wang, Thomas Guyet, René Quiniou, Marie-Odile Cordier, Florent Masseglia, et al.. Autonomic Intrusion Detection: Adaptively Detecting Anomalies over Unlabeled Audit Data Streams in Computer Networks. Knowledge-Based Systems, Elsevier, 2014, 70, pp.103-117. ⟨10.1016/j.knosys.2014.06.018⟩. ⟨hal-01052810⟩

Share

Metrics

Record views

646

Files downloads

200