NDLI: Reduction of False Alarm Rate in Detecting Network Anomaly using Mahalanobis Distance and Similarity Measure

Content Provider	IEEE Xplore Digital Library
Author	Srinivasan, N. Vaidehi, V.
Copyright Year	2007
Description	Author affiliation: Dept. of Inf. Technol., Anna Univ., Chennai (Srinivasan, N.; Vaidehi, V.)
Abstract	This paper discusses about a network anomaly detection system which is aimed at reduction of the number of false positives and negatives generated by conventional IDSs. A statistical model of the network activities is built using the payload and is trained with the normal behavior of user(s) in the network over a period of time. This model in-turn is used to detect deviations that are high from the expected behavior which indicate a security breach or a possible attack. The payload of the network traffic is analyzed by the system in an unsupervised manner and then classifies as normal traffic during training phase. The value-byte frequency of the application payload is calculated for each normal packet based on payload length and port number. The Mahalanobis distance and a similarity measure is then used to measure the similarity of the incoming data with the already computed values in the detection phase. This distance is then compared against a threshold value and generates an alert if it exceeds the value. In the clustering phase we provide a method to reduce the resource consumption which can easily update the stored profile using an incremental algorithm and the model is continuously updated so that it is accurate. The modeling method that is being followed is completely unsupervised and also tolerant to noise in the training data. The method proposed is also resistant to mimicry-attack. This system is designed to be integrated into other detectors in order to mitigate false positive rates so that this enriches the chances of detecting zero-day worms and new attack exploits
Starting Page	366
Ending Page	371
File Size	7536630
Page Count	6
File Format	PDF
ISBN	1424409969
DOI	10.1109/ICSCN.2007.350764
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2007-02-22
Publisher Place	India
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Phase measurement Intrusion detection Clustering algorithms Telecommunication traffic Detectors Traffic control Frequency Protection Phase detection Payloads
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Constant false alarm rate anomaly-based approach for network intrusion detection

A hybrid system for reducing the false alarm rate of anomaly intrusion detection system

Design of Anomaly Detection System for Outlier Detection in Hardware Profile Using PCA

Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems

Anomaly-Based Intrusion Detection using Fuzzy Rough Clustering

A case study: Intelligent false alarm reduction using fuzzy if-then rules in network intrusion detection

An efficient approach for Intrusion Detection using data mining methods

False Alarm Rate Reduction using Hybrid Model in Network Anomaly Detection

Traffic Anomaly Detection at Fine Time Scales with Bayes Nets

Reduction of False Alarm Rate in Detecting Network Anomaly using Mahalanobis Distance and Similarity Measure

Similar Documents

Constant false alarm rate anomaly-based approach for network intrusion detection

A hybrid system for reducing the false alarm rate of anomaly intrusion detection system

Design of Anomaly Detection System for Outlier Detection in Hardware Profile Using PCA

Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems

Anomaly-Based Intrusion Detection using Fuzzy Rough Clustering

A case study: Intelligent false alarm reduction using fuzzy if-then rules in network intrusion detection

An efficient approach for Intrusion Detection using data mining methods

False Alarm Rate Reduction using Hybrid Model in Network Anomaly Detection

Traffic Anomaly Detection at Fine Time Scales with Bayes Nets

Reduction of False Alarm Rate in Detecting Network Anomaly using Mahalanobis Distance and Similarity Measure