An autonomous labeling approach to support vector machines algorithms for network traffic anomaly detection

• Autores: Catania, Carlos Adrian; Bromberg, Facundo; Garcia Garino, Carlos Gabriel
• Año de publicación: 2012
• Idioma: inglés
• Tipo de recurso: artículo
• Materia: ANOMALY DETECTION; INTRUSION DETECTION SYSTEMS; LABELING; SVM
• Institución: Consejo Nacional de Investigaciones Científicas y Técnicas

In the past years, several support vector machines (SVM) novelty detection approaches have been applied on the network intrusion detection field. The main advantage of these approaches is that they can characterize normal traffic even when trained with datasets containing not only normal traffic but also a number of attacks. Unfortunately, these algorithms seem to be accurate only when the normal traffic vastly outnumbers the number of attacks present in the dataset. A situation which can not be always hold. This work presents an approach for autonomous labeling of normal traffic as a way of dealing with situations where class distribution does not present the imbalance required for SVM algorithms. In this case, the autonomous labeling process is made by SNORT, a misuse-based intrusion detection system. Experiments conducted on the 1998 DARPA dataset show that the use of the proposed autonomous labeling approach not only outperforms existing SVM alternatives but also, under some attack distributions, obtains improvements over SNORT itself.
Fil: Catania, Carlos Adrian. Universidad Nacional de Cuyo; Argentina
Fil: Bromberg, Facundo. Consejo Nacional de Investigaciones Científicas y Técnicas. Centro Científico Tecnológico Conicet - Mendoza; Argentina. Universidad Tecnológica Nacional. Facultad Regional Mendoza. Departamento de Sistemas de Información. Laboratorio DHARMA; Argentina
Fil: Garcia Garino, Carlos Gabriel. Universidad Nacional de Cuyo. Facultad de Ingeniería; Argentina. Consejo Nacional de Investigaciones Científicas y Técnicas. Centro Científico Tecnológico Conicet - Mendoza; Argentina