Data preprocessing for anomaly based network intrusion detection: A review

摘要: Data preprocessing is widely recognized as an important stage in anomaly detection. This paper reviews the data techniques used by anomaly-based network intrusion detection systems (NIDS), concentrating on which aspects of traffic are analyzed, and what feature construction selection methods have been used. Motivation for comes from large impact has accuracy capability NIDS. The review finds that many NIDS limit their view to TCP/IP packet headers. Time-based statistics can be derived these headers detect scans, worm behavior, denial service attacks. A number other perform deeper inspection request packets attacks against services applications. More recent approaches analyze full responses targeting clients. covers a wide range NIDS, highlighting classes attack detectable each approaches. found predominantly rely expert domain knowledge identifying most relevant parts constructing initial candidate set features. On hand, automated extraction reduce dimensionality, find subset features this set. shows trend toward construct more through targeted content parsing. These context sensitive required current