Applicability of clustering to cyber intrusion detection

摘要: Maintaining cyber security is a complex task, utilizing many levels of network information along with an array technology. Current practices for combating attacks typically use Intrusion Detection Systems (IDSs) to passively detect and block multi-stage attacks. Because the speed force at which new type attack can occur, automated detection response becoming apparent necessity. Anomaly-based systems, such as statistical-based or clustering algorithms, attempt address this by analyzing relative differences in host activity. Signature-based IDS systems are more accurate known attacks, but require time resources analyst update signature database. This work hypothesizes that latency from zero-day creation be shortened via anomaly-based algorithms. In particular, summarizing ability leveraged examined its applicability creation. first investigates modified density-based algorithm IDS, strengths weaknesses identified. Being able separate malicious normal activity, then applied supervised way Lessons learned development unsupervised real-time classification. Automating classification turns out satisfactory limitations. Density supports signatures diluted lead misclassification.