Principal Component-based Anomaly Detection Scheme

  • Mei-Ling Shyu
  • Shu-Ching Chen
  • Kanoksri Sarinnapakorn
  • LiWu Chang
Chapter
Part of the Studies in Computational Intelligence book series (SCI, volume 9)

Abstract

In this chapter, a novel anomaly detection scheme that uses a robust principal component classifier (PCC) to handle computer network security problems is proposed. An intrusion predictive model is constructed from the major and minor principal components of the normal instances, where the difference of an anomaly from the normal instance is the distance in the principal component space. The screening of outliers prior to the principal component analysis adds the resistance property to the classifier which makes the method applicable to both the supervised and unsupervised training data. Several experiments using the KDD Cup 1999 data were conducted and the experimental results demonstrated that our proposed PCC method is superior to the k-nearest neighbor (KNN) method, density-based local outliers (LOF) approach, and the outlier detection algorithm based on the Canberra metric.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Authors and Affiliations

  • Mei-Ling Shyu
    • 1
  • Shu-Ching Chen
    • 2
  • Kanoksri Sarinnapakorn
    • 3
  • LiWu Chang
    • 4
  1. 1.Department of Electrical and Computer EngineeringUniversity of MiamiUSA
  2. 2.School of Computer ScienceFlorida International UniversityMiamiUSA
  3. 3.Department of Electrical and Computer EngineeringUniversity of MiamiUSA
  4. 4.Center for High Assurance Computer SystemsNaval Research LaboratoryWashingtonUSA

Personalised recommendations