Anomaly detection using prior knowledge: Application to TCP/IP traffic

Alberto Carrascal, Jorge Couchet, Enrique Ferreira, Daniel Manrique

Research output: Chapter in Book/Report/Conference proceedingChapterpeer-review

5 Scopus citations

Abstract

This article introduces an approach to anomaly intrusion detection based on a combination of supervised and unsupervised machine learning algorithms. The main objective of this work is an effective modeling of the TCP/IP network traffic of an organization that allows the detection of anomalies with an efficient percentage of false positives for a production environment. The architecture proposed uses a hierarchy of Self-Organizing Maps for traffic modeling combined with Learning Vector Quantization techniques to ultimately classify network packets. The architecture is developed using the known SNORT intrusion detection system to preprocess network traffic. In comparison to other techniques, results obtained in this work show that acceptable levels of compromise between attack detection and false positive rates can be achieved.

Original languageEnglish
Title of host publicationArtificial Intelligence in Theory and Practice
Subtitle of host publicationIFIP 19th World Computer Congress, TC 12: IFIP AI 2006 Stream, August 21-24, 2006, Santiago, Chile
EditorsMax Bramer
Pages139-148
Number of pages10
DOIs
StatePublished - 2006

Publication series

NameIFIP International Federation for Information Processing
Volume217
ISSN (Print)1571-5736

Fingerprint

Dive into the research topics of 'Anomaly detection using prior knowledge: Application to TCP/IP traffic'. Together they form a unique fingerprint.

Cite this