Título: Anomaly detection using prior knowledge: application to TCP/IP traffic
Autores: Couchet, Jorge
Ferreira, Enrique
Manrique, Daniel
Carrascal, Alberto
Fecha: 2012-11-08
2006-08
2006-08
Publicador: Unversidad Nacional de La Plata
Fuente:

Tipo: Objeto de conferencia
Objeto de conferencia
Tema: intrusion detection
false positive rates
self-organizing maps
Internet (e.g., TCP/IP)
Architectures
Ciencias Informáticas
Descripción: This article introduces an approach to anomaly intrusion detection based on a combination of supervised and unsupervised machine learning algorithms. The main objective of this work is an effective modeling of the TCP/IP network traffic of an organization that allows the detection of anomalies with an efficient percentage of false positives for a production environment. The architecture proposed uses a hierarchy of Self-Organizing Maps for traffic modeling combined with Learning Vector Quantization techniques to ultimately classify network packets. The architecture is developed using the known SNORT intrusion detection system to preprocess network traffic. In comparison to other techniques, results obtained in this work show that acceptable levels of compromise between attack detection and false positive rates can be achieved.
IFIP International Conference on Artificial Intelligence in Theory and Practice - Neural Nets
Idioma: Inglés