Network Anomaly Detection Based on Clustering of Sequence Patterns

  • Sang-Kyun Noh
  • Yong-Min Kim
  • DongKook Kim
  • Bong-Nam Noh
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3981)


Anomaly detection is a method for determining behaviors which do not accord with normal ones. It is mostly used for detecting abnormal behaviors, mutational and unknown attacks. In this paper, we propose a technique that generates patterns about network-based normal behaviors in blocks of a TCP network session for the anomaly detection. One session is expressed as one pattern based on a stream of the packets in the session, and thus the pattern we generate has a sequential feature. We use the ROCK algorithm to cluster the sequence patterns which have categorical attributes. This algorithm performs clustering based on our similarity function which uses Dynamic Programming. The many sequence patterns of the normal behaviors can be reduced to several representative sequence patterns using the clustering. Our detecting sensor uses profiling dataset that are constructed by the representative sequence patterns of normal behaviors. We show the effectiveness of proposed model by using results from the 1999 DARPA Intrusion Detection Evaluation.


Intrusion Detection Sequence Pattern Anomaly Detection Categorical Attribute Port Number 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Guha, S., Rastogi, R., Sim, K.: A Clustering algorithm for categorical attributes. Technical report, Bell Laboratories, Murray Hill (1997)Google Scholar
  2. 2.
    Guha, S., Rastogi, R., Sim, K.: ROCK: A robust clustering algorithm for categorical attributes. In: Proc. IEEE International Conference on Data Engineering, Sydney (March 1999)Google Scholar
  3. 3.
    MacQueen, J.: Some methods for classifiction and analysis of multivariate observations. In: Proc. 5th Berkeley Symp., pp. 281–297 (1967)Google Scholar
  4. 4.
    Cheong, I.-A., Kim, Y.-M., Kim, M.-S., Noh, B.-N.: The Causality Analysis of Protocol Measures for Detection of Attacks based on Network. In: Kahng, H.-K., Goto, S. (eds.) ICOIN 2004. LNCS, vol. 3090, pp. 962–972. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  5. 5.
    Ng, R., Han, J.: Efficient and effective clustering method for spatial data mining. In: Proc. 1994 Int’l Conf. on VLDB, Santiago, Chile, pp.144–155 (September 1994)Google Scholar
  6. 6.
    Bloedorn, E., Christiansen, A.D., Hill, W., Skorupka, C., Talbot, L.M., Tivel, J.: Data mining for network intrusion detection: How to get started. MITRE Technical Report (August 2001)Google Scholar
  7. 7.
    Ramaswarny, S., Rastogi, R., Shim, K.: Efficient Algorithms for Mining Outliers from Large Data Sets. In: Proceedings of the ACM Sigmod 2000 Int. Conference on Management of Data, Dallas, TX (2000)Google Scholar
  8. 8.
    Breunig, M.M., Kriegel, H.P., Ng, R.T., Sander, J.: LOF: Identifying Density-Based Local Outliers. In: Proc. of the ACM Sigmod 2000 Intl. Conference on Management of Data, Dallas, TX (2000)Google Scholar
  9. 9.
    Knorr, E.M., Ng, R.T.: Algorithms for Mining Distance-Based Outliers in Large Datasets. In: VLDB 1998, Proceedings of the 24th Int. Conference on Very Large Databases, New York City, NY, August 24-27, pp. 392-403 (1998)Google Scholar
  10. 10.
    Denning, D.E.: An intrusion-detection model. IEEE Transactions on Software Engineering 13(2), 222–232 (1987)CrossRefGoogle Scholar
  11. 11.
    Sequeira, K., Zaki, M.: ADMIT: Anomaly-based data mining for intrusions. In: KDD 2002, pp. 386–395 (2002)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Sang-Kyun Noh
    • 1
  • Yong-Min Kim
    • 2
  • DongKook Kim
    • 3
  • Bong-Nam Noh
    • 3
  1. 1.Interdisciplinary Program of Information SecurityChonnam National UniversityGwangjuKorea
  2. 2.Dept. of Electronic CommerceChonnam National UniversityYeosuKorea
  3. 3.Div. of Electronics Computer & Information EngineeringChonnam National UniversityGwangjuKorea

Personalised recommendations