Detecting novel scans through pattern anomaly detection

摘要: We introduce a technique for detecting anomalous patterns in categorical feature (one that takes values from finite alphabet). It differs most anomaly detection methods used to date it does not require attack-free training data, and improves upon previous known us is aware when adequately trained generate meaningful alerts, models data as normal but falling into one of number modes discovered by competitive learning. apply the port TCP sessions (the alphabet being numbers) highlight interesting detected simulated real traffic. propose extensions where learned pattern library can be seeded some interest labeled, so certain an alert no matter how frequently they are observed, while others labeled benign do alerts even if rarely seen. Finally, we outline hybrid system approach closely integrate misuse detection, arguing historical dichotomy with which many researchers these techniques now artificial.