Unsupervised Network Intrusion Detection Systems: Detecting the Unknown without Knowledge - LAAS-Réseaux et Communications Accéder directement au contenu
Article Dans Une Revue Computer Communications Année : 2012

Unsupervised Network Intrusion Detection Systems: Detecting the Unknown without Knowledge

Résumé

Traditional Network Intrusion Detection Systems (NIDSs) rely on either specialized signatures of previously seen attacks, or on expensive and difficult to produce labeled traffic datasets for user-profiling to hunt out network attacks. Despite being opposite in nature, both approaches share a common downside: they require the knowledge provided by an external agent, either in terms of signatures or as normal-operation profiles. In this paper we present UNIDS, an Unsupervised Network Intrusion Detection System capable of detecting unknown network attacks without using any kind of signatures, labeled traffic, or training. UNIDS uses a novel unsupervised outliers detection approach based on Sub-Space Clustering and Multiple Evidence Accumulation techniques to pin-point different kinds of network intrusions and attacks such as DoS/DDoS, probing attacks, propagation of worms, buffer overflows, illegal access to network resources, etc. We evaluate UNIDS in three different traffic datasets, including the well-known KDD99 dataset as well as real traffic traces from two operational networks. We particularly show the ability of UNIDS to detect unknown attacks, comparing its performance against traditional misuse-detection-based NIDSs. In addition, we also evidence the supremacy of our outliers detection approach with respect to different previously used unsupervised detection techniques.
Fichier principal
Vignette du fichier
paper_comcom_2011.pdf (623.18 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-00736278 , version 1 (28-09-2012)

Identifiants

  • HAL Id : hal-00736278 , version 1

Citer

Pedro Casas Hernandez, Johan Mazel, Philippe Owezarski. Unsupervised Network Intrusion Detection Systems: Detecting the Unknown without Knowledge. Computer Communications, 2012, 35 (7), pp.772-783. ⟨hal-00736278⟩
355 Consultations
3352 Téléchargements

Partager

Gmail Facebook X LinkedIn More