data stream subspace clustering for anomalous network packet detection数据流异常网络数据包检测的子空间聚类.pdfVIP

Journal of Information Security, 2012, 3, 215-223 /10.4236/jis.2012.33027 Published Online July 2012 (http://www.SciRP.org/journal/jis) Data Stream Subspace Clustering for Anomalous Network Packet Detection Zachary Miller, Wei Hu Department of Computer Science, Houghton College, Houghton, USA Email: wei.hu@ Received March 17, 2012; revised April 26, 2012; accepted May 5, 2012 ABSTRACT As the Internet offers increased connectivity between human beings, it has fallen prey to malicious users who exploit its resources to gain illegal access to critical information. In an effort to protect computer networks from external attacks, two common types of Intrusion Detection Systems (IDSs) are often deployed. The first type is signature-based IDSs which can detect intrusions efficiently by scanning network packets and comparing them with human-generated signa- tures describing previously-observed attacks. The second type is anomaly-based IDSs able to detect new attacks through modeling normal network traffic without the need for a human expert. Despite this advantage, anomaly-based IDSs are limited by a high false-alarm rate and difficulty detecting network attacks attempting to blend in with normal traffic. In this study, we propose a StreamPreDeCon anomaly-based IDS. StreamPreDeCon is an extension of the pref- erence subspace clustering algorithm PreDeCon designed to resolve some of the challenges associated with anomalous packet detection. Using network packets extracted from the first week of the DARPA ’99 intrusion detection evaluation dataset combined with Generic Http, Shellcode and CLET attacks, our IDS achieved 94.4% sensitivity and 0.726% false positives in a best ca