| Presentation | 2013-03-14 A Study of the Anomaly Detection Method Characteristics based on the Traffic Parameter Clustering Kouhei TATSUMI, Toyokazu AKIYAMA, |
|---|---|
| PDF Download Page |  PDF download Page Link |
| Abstract(in Japanese) | (See Japanese page) |
| Abstract(in English) | The "targeted attacks" especially to the government and the companies increase in recent years. Such unknown attacks are difficult to detect by signature-based IDSs, and it is said that anomaly-based IDS can detect them effectively. In this study, we investigated the applicability of an existing anomaly detection method to the practical environment. The method is classified to the anomaly-based method and it uses the degree of deviation from the normal state. In the method, at first, the features of the normal state is extracted by clustering normal traffic parameters using k-means method. Then, it calculates the degree of deviation from the normal state for the newly observed traffic. We implemented the method using the R and Ruby. Then, we apply it to detect anomalies using the 1999 Darpa Intrusion Detection Data Set. Since the k-means method requires the number of clusters decide before clustering, the existing method uses the parameter R(k)to find the approproate number. The literature, describes that R(k) will converge when the number of the cluster k increases, and k will be the optimal when R(k) is within E of the converged value. However, R(k) did not converge with the Data set. Therefore, we will compare the fixed k value used in the existing methods and the x-means method which automatically determines the appropriate k value. |
| Keyword(in Japanese) | (See Japanese page) |
| Keyword(in English) | anomaly detection / clustering |
| Paper # | SITE2012-49,IA2012-87 |
| Date of Issue |
| Conference Information | |
| Committee | SITE |
|---|---|
| Conference Date | 2013/3/7(1days) |
| Place (in Japanese) | (See Japanese page) |
| Place (in English) | |
| Topics (in Japanese) | (See Japanese page) |
| Topics (in English) | |
| Chair | |
| Vice Chair | |
| Secretary | |
| Assistant | |
| Paper Information | |
| Registration To | Social Implications of Technology and Information Ethics (SITE) |
|---|---|
| Language | JPN |
| Title (in Japanese) | (See Japanese page) |
| Sub Title (in Japanese) | (See Japanese page) |
| Title (in English) | A Study of the Anomaly Detection Method Characteristics based on the Traffic Parameter Clustering |
| Sub Title (in English) | |
| Keyword(1) | anomaly detection |
| Keyword(2) | clustering |
| 1st Author's Name | Kouhei TATSUMI |
| 1st Author's Affiliation | Faculty of Computer Science and Engineering, Kyoto Sangyo University() |
| 2nd Author's Name | Toyokazu AKIYAMA |
| 2nd Author's Affiliation | Faculty of Computer Science and Engineering, Kyoto Sangyo University |
| Date | 2013-03-14 |
| Paper # | SITE2012-49,IA2012-87 |
| Volume (vol) | vol.112 |
| Number (no) | 488 |
| Page | pp.pp.- |
| #Pages | 6 |
| Date of Issue | |