Adaptive real-time anomaly detection with incremental clustering

摘要: Anomaly detection in information (IP) networks, of deviations from what is considered normal, an important complement to misuse based on known attack descriptions. Performing anomaly real-time places hard requirements the algorithms used. First, deal with massive data volumes one needs have efficient structures and indexing mechanisms. Secondly, dynamic nature today's networks makes characterisation normal requests services difficult. What as during some time interval may be classified abnormal a new context, vice versa. These factors make many proposed mining techniques less suitable for intrusion detection. In this paper we present ADWICE, Detection With fast Incremental Clustering, propose grid index that shown improve performance while preserving efficiency search. Moreover, two mechanisms adaptive evolution normality model: incremental extension elements behaviour, feature enables forgetting outdated behaviour. address network environment such telecom management network. We evaluate technique network-based detection, using KDD set well IP test The experiments show good quality act proof concept adaptation normality.