Learning Rules and Clusters for Anomaly Detection in Network Traffic

摘要: Much of the intrusion detection research focuses on signature (misuse) detection, where models are built to recognize known attacks. However, by its nature, cannot detect novel Anomaly modeling normal behavior and identifying significant deviations, which could be In this chapter we explore two machine learning methods that can construct anomaly from past behavior. The first method is a rule algorithm characterizes in absence labeled attack data. second uses clustering identify outliers.