NDLI: A Generalized Feature Extraction Scheme to Detect 0-Day Attacks via IDS Alerts

Content Provider	IEEE Xplore Digital Library
Author	Jungsuk Song Takakura, H. Yongjin Kwon
Copyright Year	2008
Description	Author affiliation: Grad. Sch. of Inf., Kyoto Univ., Kyoto (Jungsuk Song)
Abstract	Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it still suffers from detecting an unknown attack, i.e., 0-day attack, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack. Unlike the existing approaches that investigate raw traffic data, we introduced a feature extraction method in order to detect such an attack from IDS alerts [J. Song et al., 2007]. However, there is a problem that it can be only applied to limited IDS products. In this paper, we present a generalized version of the feature extraction method. To this end, we define new 7 features using only the basic 6 features of IDS alerts; detection time, source address and port, destination address and port, and signature name. In order to detect 0-day attack from IDS alerts with new 7 features, we apply an unsupervised learning technique, One-class SVM, to them. We evaluated our method over the log data of IDS that is deployed in Kyoto University, and our experimental results show that it has capability to detect not only a type of 0-day attack detected in our previous study, but also several different types of 0-day attack.
Starting Page	55
Ending Page	61
File Size	1103779
Page Count	7
File Format	PDF
ISBN	9780769532974
DOI	10.1109/SAINT.2008.85
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2008-07-28
Publisher Place	Finland
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Feature extraction Support vector machines Data mining Security Training data Testing Classification algorithms
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Unknown Attacks Detection Using Feature Extraction from Anomaly-Based IDS Alerts

Classification of Attacks Using Support Vector Machine (SVM) on KDDCUP'99 IDS Database

A cooperative feature gene extraction algorithm that combines classification and clustering

Rule Extraction from Support Vector Machines and Its Applications

A Feature Selection for Malicious Detection

Minority identification for imbalanced dataset

Overcomplete Knowledge Mining, Organization and Ensemble: A Multiple Kernel Support Vector Machine Approach

A novel multi-instance learning algorithm with application to image classification

Extracting parallel phrases from comparable corpora

A Generalized Feature Extraction Scheme to Detect 0-Day Attacks via IDS Alerts

Similar Documents

Unknown Attacks Detection Using Feature Extraction from Anomaly-Based IDS Alerts

Classification of Attacks Using Support Vector Machine (SVM) on KDDCUP'99 IDS Database

A cooperative feature gene extraction algorithm that combines classification and clustering

Rule Extraction from Support Vector Machines and Its Applications

A Feature Selection for Malicious Detection

Minority identification for imbalanced dataset

Overcomplete Knowledge Mining, Organization and Ensemble: A Multiple Kernel Support Vector Machine Approach

A novel multi-instance learning algorithm with application to image classification

Extracting parallel phrases from comparable corpora

A Generalized Feature Extraction Scheme to Detect 0-Day Attacks via IDS Alerts