상세정보
학술지
Self-Adaptive and Dynamic Clustering for Online Anomaly Detection
- 저자
- 이승민, 김기성, 김세헌
- 발행일
- 201111
- 출처
- Expert Systems with Applications, v.38 no.12, pp.14891-14898
- ISSN
- 0957-4174
- 출판사
- Elsevier
- 협약과제
- 11PR5300, Beyond 스마트 TV 기술 개발, 홍진우
- 초록
- As recent Internet threats are evolving more rapidly than ever before, one of the major challenges in designing an intrusion detection system is to provide early and accurate detection of emerging threats. In this study, a novel framework is developed for fully unsupervised training and online anomaly detection. The framework is designed so that an initial model is constructed and then it gradually evolves according to the current state of online data without any human intervention. In the framework, a self-organizing map (SOM) that is seamlessly combined with K-means clustering is transformed into an adaptive and dynamic algorithm suitable for real-time processing. The performance of the proposed approach is evaluated through experiments using the well-known KDD Cup 1999 data set and further experiments using the honeypot data recently collected from Kyoto University. It is shown that the proposed approach can significantly increase the detection rate while the false alarm rate remains low. In particular, it is capable of detecting new types of attacks at the earliest possible time. © 2011 Elsevier Ltd. All rights reserved.
- KSP 제안 키워드
- Current state, Data sets, Dynamic Clustering, Dynamic algorithm, Emerging threats, False Alarm Rate, Internet threat, Intrusion detection system(IDS), KDD Cup 1999, Online anomaly detection, Online data