Data Mining for Intrusion Detection: from Outliers to True Intrusions - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2009

Data Mining for Intrusion Detection: from Outliers to True Intrusions

Résumé

Data mining for intrusion detection can be divided into several subtopics, among which unsupervised clustering has controversial properties. Unsupervised clustering for intrusion detection aims to i) group behaviors together depending on their similarity and ii) detect groups containing only one (or very few) behaviour. Such isolated behaviours are then considered as deviating from a model of normality and are therefore considered as malicious. Obviously, all atypical behaviours are not attacks or intrusion attempts. Hence, this is the limits of unsupervised clustering for intrusion detection. In this paper, we consider to add a new feature to such isolated behaviours before they can be considered as malicious. This feature is based on their possible repetition from one information system to another. We propose a new outlier mining principle and validate it through a set of experiments.
Fichier principal
Vignette du fichier
442.pdf (135.81 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

inria-00359206 , version 1 (06-02-2009)
inria-00359206 , version 2 (28-10-2009)

Identifiants

Citer

Goverdhan Singh, Florent Masseglia, Céline Fiot, Alice Marascu, Pascal Poncelet. Data Mining for Intrusion Detection: from Outliers to True Intrusions. PAKDD 2009 - 13th Pacific-Asia Conference on Knowledge Discovery and Data Mining, Apr 2009, Bankok, Thailand. pp.891-898, ⟨10.1007/978-3-642-01307-2_93⟩. ⟨inria-00359206v2⟩
209 Consultations
747 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More