Unsupervised anomaly detection using an evolutionary extension of k-means algorithm. (2nd June 2008)

• Record Type: Journal Article
• Authors: Lu, Wei; Traore, Issa
• Is Part Of: International journal of information and computer security. Volume 2:Number 2(2008)
• Page Start: 107
• Page End: 139
• Publication Date: 2008-06-02
• Subjects: intrusion detection -- unsupervised anomaly detection -- clustering algorithms -- Gaussian mixture model -- evolutionary computation -- information security -- computer security -- network intrusions; Computer security -- Periodicals; Information systems management -- Security measures -- Periodicals; Computer networks -- Security measures -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• Languages: English
• ISSNs: 1744-1765

Abstract

In this paper, we propose a new unsupervised anomaly detection framework for network intrusions. The framework consists of a new clustering algorithm named I-means and new anomalousness metrics named IP Weights. I-means is an evolutionary extension of k means algorithm that estimates automatically the number of clusters for a set of data. IP Weights allow the automatic conversion of regular packet features into a 3-dimensional numerical feature space. Online and offline evaluations show not only strong detection effectiveness, but also strong runtime efficiency, with response times falling within a few seconds ranges.