TY - JOUR
T1 - Min-max hyperellipsoidal clustering for anomaly detection in network security
AU - Sarasamma, Suseela T.
AU - Zhu, Qiuming A.
N1 - Funding Information:
Manuscript received March 30, 2005; revised August 27, 2005 and December 1, 2005. This work was supported in part by the Air Force Research Laboratory, Rome, New York and in part by the Advanced Research Development Agency under Grant F30602-03-C-0247. This paper was recommended by Associate Editor M. Obaidat.
PY - 2006/8
Y1 - 2006/8
N2 - A novel hyperellipsoidal clustering technique is presented for an intrusion-detection system in network security. Hyperellipsoidal clusters toward maximum intracluster similarity and minimum intercluster similarity are generated from training data sets. The novelty of the technique lies in the fact that the parameters needed to construct higher order data models in general multivariate Gaussian functions are incrementally derived from the data sets using accretive processes. The technique is implemented in a feedforward neural network that uses a Gaussian radial basis function as the model generator. An evaluation based on the inclusiveness and exclusiveness of samples with respect to specific criteria is applied to accretively learn the output clusters of the neural network. One significant advantage of this is its ability to detect individual anomaly types that are hard to detect with other anomaly-detection schemes. Applying this technique, several feature subsets of the tcptrace network-connection records that give above 95% detection at false-positive rates below 5% were identified.
AB - A novel hyperellipsoidal clustering technique is presented for an intrusion-detection system in network security. Hyperellipsoidal clusters toward maximum intracluster similarity and minimum intercluster similarity are generated from training data sets. The novelty of the technique lies in the fact that the parameters needed to construct higher order data models in general multivariate Gaussian functions are incrementally derived from the data sets using accretive processes. The technique is implemented in a feedforward neural network that uses a Gaussian radial basis function as the model generator. An evaluation based on the inclusiveness and exclusiveness of samples with respect to specific criteria is applied to accretively learn the output clusters of the neural network. One significant advantage of this is its ability to detect individual anomaly types that are hard to detect with other anomaly-detection schemes. Applying this technique, several feature subsets of the tcptrace network-connection records that give above 95% detection at false-positive rates below 5% were identified.
KW - Accretive construction
KW - Anomaly detection
KW - Confidence measurement
KW - Hyperellipsoidal clustering
KW - Neural networks
KW - Self-organizing map (SOM)
UR - http://www.scopus.com/inward/record.url?scp=33746809369&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=33746809369&partnerID=8YFLogxK
U2 - 10.1109/TSMCB.2006.870629
DO - 10.1109/TSMCB.2006.870629
M3 - Article
C2 - 16903372
AN - SCOPUS:33746809369
SN - 1083-4419
VL - 36
SP - 887
EP - 901
JO - IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics
JF - IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics
IS - 4
ER -