Network Anomaly Detection Based on Clustering of Sequence Patterns
Anomaly detection is a method for determining behaviors which do not accord with normal ones. It is mostly used for detecting abnormal behaviors, mutational and unknown attacks. In this paper, we propose a technique that generates patterns about network-based normal behaviors in blocks of a TCP network session for the anomaly detection. One session is expressed as one pattern based on a stream of the packets in the session, and thus the pattern we generate has a sequential feature. We use the ROCK algorithm to cluster the sequence patterns which have categorical attributes. This algorithm performs clustering based on our similarity function which uses Dynamic Programming. The many sequence patterns of the normal behaviors can be reduced to several representative sequence patterns using the clustering. Our detecting sensor uses profiling dataset that are constructed by the representative sequence patterns of normal behaviors. We show the effectiveness of proposed model by using results from the 1999 DARPA Intrusion Detection Evaluation.
KeywordsIntrusion Detection Sequence Pattern Anomaly Detection Categorical Attribute Port Number
Unable to display preview. Download preview PDF.
- 1.Guha, S., Rastogi, R., Sim, K.: A Clustering algorithm for categorical attributes. Technical report, Bell Laboratories, Murray Hill (1997)Google Scholar
- 2.Guha, S., Rastogi, R., Sim, K.: ROCK: A robust clustering algorithm for categorical attributes. In: Proc. IEEE International Conference on Data Engineering, Sydney (March 1999)Google Scholar
- 3.MacQueen, J.: Some methods for classifiction and analysis of multivariate observations. In: Proc. 5th Berkeley Symp., pp. 281–297 (1967)Google Scholar
- 5.Ng, R., Han, J.: Efficient and effective clustering method for spatial data mining. In: Proc. 1994 Int’l Conf. on VLDB, Santiago, Chile, pp.144–155 (September 1994)Google Scholar
- 6.Bloedorn, E., Christiansen, A.D., Hill, W., Skorupka, C., Talbot, L.M., Tivel, J.: Data mining for network intrusion detection: How to get started. MITRE Technical Report (August 2001)Google Scholar
- 7.Ramaswarny, S., Rastogi, R., Shim, K.: Efficient Algorithms for Mining Outliers from Large Data Sets. In: Proceedings of the ACM Sigmod 2000 Int. Conference on Management of Data, Dallas, TX (2000)Google Scholar
- 8.Breunig, M.M., Kriegel, H.P., Ng, R.T., Sander, J.: LOF: Identifying Density-Based Local Outliers. In: Proc. of the ACM Sigmod 2000 Intl. Conference on Management of Data, Dallas, TX (2000)Google Scholar
- 9.Knorr, E.M., Ng, R.T.: Algorithms for Mining Distance-Based Outliers in Large Datasets. In: VLDB 1998, Proceedings of the 24th Int. Conference on Very Large Databases, New York City, NY, August 24-27, pp. 392-403 (1998)Google Scholar
- 11.Sequeira, K., Zaki, M.: ADMIT: Anomaly-based data mining for intrusions. In: KDD 2002, pp. 386–395 (2002)Google Scholar